Alpine Linux Rebuilds GitLab After Attempted Exploitation of Critical GitLab RCE Flaw (CVE‑2026‑97229)
What Happened — On October 20‑21 2026, threat actors attempted to exploit CVE‑2026‑97229, a maximum‑severity integer‑overflow RCE vulnerability in GitLab’s CI/CD regular‑expression compiler (Onigmo). The attackers submitted malicious CI pipeline configurations that repeatedly crashed GitLab worker processes; four of eight attempts came close to successful code execution. Alpine Linux, which hosts its development repositories and CI jobs on a self‑managed GitLab instance, could not confirm whether code was executed because relevant logs were missing and outbound connection records were unavailable. To eliminate any doubt, Alpine rebuilt the GitLab server from scratch, reset all passwords, and upgraded to a fully patched version (GitLab 19.3.6 with the required Ruby patch). No tampering of source code, packages, or signing keys was detected, but the incident highlighted the risk of supply‑chain compromise through CI/CD pipelines.
Why It Matters for Trust & Control Assurance — The episode tests the control objective of maintaining a secure software supply chain and immutable CI/CD audit evidence.
Who Is Affected — Cloud‑infrastructure providers, open‑source project maintainers, and organizations that rely on GitLab‑based CI/CD pipelines.
Recommended Actions
- Verify that all CI/CD tools run the latest patched versions and that custom container images include upstream security fixes.
- Implement immutable, centrally retained logs for CI pipeline execution and GitLab activity to provide defensible audit evidence.
- Conduct a supply‑chain risk assessment of your build environment and enforce code‑signing verification.
Technical Notes
- Attack vector: Vulnerability exploit via crafted regular expressions in CI/CD pipeline configuration.
- CVE: CVE‑2026‑97229 (GitLab CI/CD Onigmo integer overflow).
- Potentially exposed data: User accounts, password hashes, 2FA secrets, CI/CD secrets, integration credentials, private repository content.
- Status: No confirmed breach; Alpine Linux rebuilt GitLab and reset credentials.
Source: BleepingComputer