Alpine Linux rebuilt its GitLab server from scratch and reset all passwords after attackers spent October 20 and 21 trying to exploit a critical GitLab vulnerability in the project's development infrastructure. The open-source operating system, whose lightweight design underpins many Docker container images, took the step because it could not determine whether the attempts had succeeded.
The flaw, tracked as CVE-2026-97229, is a maximum-severity remote code execution vulnerability. It is an integer overflow in GitLab's CI/CD regular expression compiler Onigmo, which is bundled in Ruby, and it could let unauthenticated attackers run arbitrary code on a server. GitLab published the flaw and fixes on October 12, warning that a specially crafted regular expression submitted in a CI/CD pipeline configuration could trigger it under certain conditions.
Alpine first deployed GitLab 19.3.4 rather than the patched 19.3.5. Upgrading later to 19.3.6 also did not eliminate the flaw, because the remedy required a patch to Ruby; GitLab's official packages included that patch, but Alpine's custom container image did not. During the two-day attack, malicious CI configurations caused eight worker crashes, four of which were partially successful, though none appeared to fully work. The Alpine Linux team also found that the attackers had downloaded its GitLab container image, a sign they may have been laying groundwork for a supply-chain attack.
Alpine's GitLab instance holds development repositories, code reviews and CI jobs, including the aports build recipes used to produce the operating system's packages, which makes it a valuable supply-chain target. Investigating through October 27, the team found no tampering in repository commits, packages or releases, and no signing keys could have been exposed because those are not kept on the GitLab server.
The team said the missing logs and absent outbound connection records left it unable to confirm or exclude code execution, and that the evidence needed to settle the question no longer existed. It therefore chose what it described as the harder route and rebuilt the GitLab instance from scratch.
Data that could have been exposed in a successful exploit includes user details, password hashes, 2FA secrets, CI/CD secrets, integration credentials and private project content, though none of that has been confirmed as compromised.
Alpine is directing users to reset their GitLab passwords and to pull the alpinelinux/gitlab:19.3.6 image published on October 27, which ships Ruby 3.3.13 and addresses CVE-2026-97229.
More cybersecurity news from TechManNews.
