Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
SecurityWeek, Friday, October 30th, 2026
A max-severity GitLab flaw, CVE-2026-97229, was exploited a week after disclosure against Alpine Linux's instance in an attack that failed.
CVE-2026-97229 (CVSS 10) stems from insufficient regular expression validation in Onigmo, Ruby's regex engine, and could let an unauthenticated user run code on a GitLab server via a crafted CI/CD configuration.
Alpine Linux said an attacker targeted its instance on October 20 and 21 using a new account, crashing worker processes and downloading its container image, apparently to tune the exploit.
Alpine found no evidence of code execution, though it cannot rule it out, rebuilt the instance, reset passwords and says its repository, packages and releases were not tampered with.
Because the bug is in Ruby, updating to GitLab 19.3.6 did not fix it for Alpine's image.