Security reports have revealed that the Alpine Linux distribution was subjected to an attempted exploitation of a critical-grade vulnerability in the GitLab platform, a flaw that allows unauthorized attackers to execute arbitrary software (RCE) on the server. The vulnerability, identified as CVE-2026-97229, received a severity score of 10/10 on the CVSS scale, making it one of the most dangerous current threats.
Attack Details and Technical Mechanism
According to Alpine Linux data, a threat actor targeted the distribution's GitLab instance on October 20 and 21. The attack began by using a newly registered account to send specially crafted CI/CD configuration files, which caused worker processes to crash. Although the attack did not succeed in compromising the core systems, the attackers demonstrated a high level of professionalism; they downloaded the GitLab container image, indicating an attempt to "fine-tune" the exploit to match the target environment precisely.
This vulnerability arises from a weakness in Regular Expression validation within the Onigmo engine, which is the engine used in the Ruby programming language. Since the vulnerability lies in the language engine rather than the GitLab code itself, the traditional platform update process may not be sufficient for protection.
What Does This Mean for Users and Administrators?
This development poses a technical challenge for organizations that do not rely on pre-packaged GitLab bundles but instead run GitLab using a custom Ruby version or from source. In this case, updating GitLab to version 19.3.6 alone will not be enough; the Ruby language must be updated independently to ensure the vulnerability is patched.
To ensure protection, it must be verified that the following versions of Ruby or later are being used:
International Response
For its part, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the CVE-2026-97229 vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and issued urgent directives to federal agencies to address this vulnerability within a maximum of three days.