GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

What it is

CVE-2026-97229 is a critical (CVSS 10.0) flaw in how GitLab evaluates regular expressions in CI configuration. The bug is in Onigmo, the regex engine built into Ruby. GitLab published fixed releases on 12 October 2026. Upstream Ruby shipped its fix on 23 October 2026, in Ruby 3.3.13, 3.4.12 and 4.0.9.

Preconditions / Affected

The key point for anyone running their own build: GitLab's fix is a set of patches to the Ruby that GitLab bundles, applied only in GitLab's official packages and container images. It is not in GitLab's own code. Alpine's image used standard Ruby, so upgrading from 19.3.4 to 19.3.6 on 22 October 2026 left it vulnerable.

You are exposed if you run GitLab from source or in your own container image with a Ruby older than 3.3.13, 3.4.12 or 4.0.9, even on a patched GitLab version. The Alpine write-up also says any program that compiles regular expressions from untrusted input is exposed, not only GitLab.

What to do

• Self-built GitLab: upgrade GitLab and also move to Ruby 3.3.13, 3.4.12, 4.0.9 or later.
• alpinelinux/gitlab image: pull alpinelinux/gitlab:19.3.6 again. Only the image published on 27 October 2026 contains Ruby 3.3.13. Earlier 19.3.6 pulls and all older tags are vulnerable.
• Alpine's ruby package: Alpine 3.22, 3.23, 3.24 and edge ship Ruby 3.4.12, and Alpine 3.21 ships 3.3.13. Both include the fix.

apk upgrade

• Check each GitLab security release for Ruby or other component patches that your own build must apply. Alpine now aims to apply critical releases within a day.
• If you had an account on gitlab.alpinelinux.org: all passwords were reset, so use "Forgot your password?" when the instance reopens. Change the password anywhere else you reused it, since Alpine saw automated logins using passwords leaked from other sites.

How the attack went

A newly registered account sent crafted CI configurations on 20 and 21 October 2026 to an instance still on 19.3.4. This crashed workers 8 times. In 4 of those crashes the attacker got partway through the exploit and failed at the next step. The attacker also downloaded Alpine's GitLab container image, which suggests they were tuning the exploit to that exact build. A successful exploit would leave no crash and no trace in web logs.

Caveats

Alpine found no evidence of code execution (no timing delays, unexpected files, keys, hooks or processes) but cannot rule it out. Some logs from the attack day are gone, and neither Alpine nor its host logged outbound connections. It treated the instance as compromised and rebuilt it.

If the exploit had succeeded, exposed data could include user emails, names and IPs, password hashes, 2FA secrets, CI/CD variables, runner tokens, integration credentials, personal access tokens (stored as hashes), and private repositories and confidential issues.

Alpine's integrity checks found no tampering with aports, packages or the 21 October releases (3.21.9, 3.22.7, 3.23.7, 3.24.3). It compared commits from 20 to 22 October against a developer's clone and all 45 builders. Signing keys were never stored on the GitLab server. These checks ran on 24 October 2026, and Alpine is extending them to 27 October 2026, when it closed the vulnerable instance.