Critical Remote Code Execution in GitLab CI (CVE‑2026‑97229) Targeted on Alpine Linux’s GitLab Instance
What It Is — A newly disclosed GitLab vulnerability (CVE‑2026‑97229) scores a perfect 10.0 on the CVSS scale. The flaw resides in GitLab’s handling of regular expressions within CI configuration files; a crafted regex can trigger arbitrary code execution on the GitLab server. GitLab issued a patch on 28 October 2026, and the Alpine Linux project reported that an attacker attempted to exploit the flaw on its own GitLab instance within a week of the fix. No successful compromise was observed, but the attempt underscores the risk of un‑sanitized CI inputs on any GitLab deployment.
Affected Products — GitLab (any version prior to the 28 Oct 2026 patch) running on Alpine Linux’s self‑hosted GitLab server.
Why It Matters for Trust & Control Assurance — The incident tests the control objective of secure CI/CD pipeline configuration and code‑integrity assurance. Continuous evidence that CI definitions are validated and monitored is essential for meeting multiple frameworks (e.g., NIST CSF, ISO 27001).
Recommended Actions
- Apply GitLab’s 28 Oct 2026 security update immediately.
- Review all CI/CD pipeline definitions for risky regular‑expression patterns; enforce a whitelist of allowed constructs.
- Enable GitLab’s audit logging for CI job creation and execution, and integrate logs into a SIEM for real‑time detection of anomalous activity.
- Incorporate automated static analysis of CI files into your DevSecOps pipeline to catch similar issues before they reach production.
Source: The Hacker News