Alpine Linux GitLab Server Targeted by Exploit for Critical Ruby Vulnerability

Exploitation Attempt on Alpine Linux GitLab

On October 28, Alpine Linux reported an attempted exploitation of a critical GitLab vulnerability (CVE-2026-97229) on its GitLab server. The attack occurred approximately one week after GitLab released a patch for the flaw. The vulnerability, which carries a CVSS score of 10.0, enables an attacker to execute arbitrary code on a GitLab server by injecting a specially crafted regular expression into a CI configuration.

Server Rebuild and Password Resets

Although Alpine Linux found no definitive evidence that the attack was successful, it could not entirely rule out compromise. As a precautionary measure, the project rebuilt its GitLab server from scratch and initiated a password reset for all user accounts. This action was taken to mitigate any potential risks associated with the attempted breach.

Incomplete Patching Due to Ruby Dependency

The incident revealed a critical detail regarding the vulnerability's fix: GitLab's patch specifically targets the Ruby versions shipped within its own packages and container images. Alpine's GitLab image utilized a standard Ruby installation, meaning that upgrading the GitLab server to version 19.3.6 on October 22 did not resolve the underlying Ruby vulnerability. This left the server exposed despite the GitLab version update.

Implications for Self-Hosted GitLab Instances

Alpine Linux warned that organizations running GitLab with their own Ruby installations (e.g., built from source or in custom container images) must update their Ruby versions to 3.3.13, 3.4.12, 4.0.9, or later, in addition to upgrading GitLab itself. Users of Alpine's `alpinelinux/gitlab` image were advised to pull version 19.3.6 again to ensure they receive the necessary Ruby updates. The `gitlab.alpinelinux.org` server hosts `aports`, the repository for Alpine's package builds. Alpine verified packages built between October 20-24 and the October 21 releases against external records. Package and release signing keys were not stored on the GitLab server.

Attack Timeline and Attacker Actions

The attack began on October 20, when a newly registered account started probing the server, which was mistakenly running GitLab 19.3.4 (without the October 12 fix). On October 20 and 21, the attacker sent crafted CI configurations, causing GitLab worker process crashes and 502 errors. Alpine noted that in four instances, the attacker partially executed the exploit. The attacker also downloaded Alpine's GitLab container image, suggesting exploit tuning. Alpine blocked the account on October 23, with subsequent attempts by the attacker on October 25 and 26 failing. The vulnerability was discovered on October 26, leading to the server's closure on October 27.