Alpine Linux rebuilds GitLab after attempted RCE attack

Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20–21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.

The attacks targeted CVE-2026-97229, a maximum-severity remote code execution flaw, repeatedly crashing GitLab processes, with some attempts coming close to succeeding.

Although Alpine Linux found no evidence that attackers executed code or tampered with its software packages and releases, it could not rule out a successful compromise due to missing logs and a lack of outbound connection records.

"Because we cannot rule out code execution, and the evidence we would need to confirm it no longer exists, we took the harder route and rebuilt the GitLab instance from scratch," explained the Alpine Linux team.

Alpine Linux is a small, lightweight operating system widely used as the foundation for Docker container images that run applications and services.

Their GitLab instance hosts development repositories, code reviews, and CI jobs, including the "aports" build recipes used to produce Alpine’s software packages.

That makes it a valuable supply chain target, as tampering with their GitLab environment could affect downstream software.

CVE-2026-97229 is a maximum-severity integer overflow vulnerability in GitLab’s CI/CD regular expression compiler Onigmo, bundled in Ruby, that could allow unauthenticated attackers to execute arbitrary code on the server.

GitLab disclosed the flaw and made fixes available on October 12, warning that attackers can trigger it under certain conditions by submitting a specially crafted regular expression in a CI/CD pipeline configuration.

Alpine initially installed GitLab 19.3.4 instead of the patched version, 19.3.5. A later upgrade to 19.3.6 also failed to close the flaw because the fix required a patch to Ruby, which GitLab bundled with its official packages but Alpine’s custom container image did not include.

On October 20-21, the attacker submitted malicious CI configurations targeting the flaw, causing eight worker crashes; four were partially successful, though none seemed to go all the way.

The Alpine Linux team found that the attackers downloaded its GitLab container image, suggesting they may have been preparing a supply-chain attack.

After investigating, Alpine found no tampering in the repository commits, packages, or releases up to October 27. Also, no signing keys could have been exposed, as those aren’t stored on the GitLab server.

Incident timeline
Source: Alpine Linux

If exploitation succeeded, potentially exposed information includes user details, password hashes, 2FA secrets, CI/CD secrets, integration credentials, and private project content, though no compromise of the above has been confirmed.

Alpine advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on October 27, which contains Ruby 3.3.13 and addresses CVE-2026-97229.