Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Vulnerabilities

Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.

By

Ionut Arghire

| October 30, 2026 (5:32 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

A recent code execution vulnerability in GitLab was exploited one week after disclosure in a failed attack against Alpine Linux’s instance.

Tracked as CVE-2026-97229 (CVSS score of 10/10), the flaw stems from insufficient regular expression validation in Onigmo, Ruby’s regular expression engine.

The bug “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration,” GitLab noted in an October 12 advisory.

According to Alpine Linux, a threat actor targeted its GitLab instance with a CVE-2026-97229 exploit on October 20 and 21. The attack failed, but the Linux distribution rebuilt the instance from scratch.

“Our checks show that the aports repository, packages, and the October 21 releases were not tampered with,” Alpine Linux notes.

It is still testing the GitLab instance before public release, and has reset all passwords, warning of observed automated login attempts using passwords compromised in other leaks.

Advertisement. Scroll to continue reading.

As part of the October 20-21 attack, the hackers used a newly registered account to send crafted CI configurations to Alpine Linux’s GitLab instance, crashing the worker process.

“In 4 of those crashes, the attacker got partway through the exploit and failed at the next step. The attacker also downloaded our GitLab container image, which suggests they were tuning the exploit to our exact build. We have found no evidence that the attacker ran code on the server, but we cannot rule it out,” Alpine Linux says.

Because the underlying vulnerability resides in Ruby, not in GitLab, and the Linux distribution’s image runs standard Ruby, the vulnerability was not patched after updating to GitLab 19.3.6.

“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.

On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.

Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines

Related:Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

Related:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Related:Hackers Start Probing Fresh Oracle EBS Vulnerability

Written ByIonut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Ionut Arghire

  • Over 41,000 DHS Employee Records Leaked Online
  • HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
  • Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
  • Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
  • Chrome and Firefox Updates Patch Over 200 Vulnerabilities
  • China-Linked Hackers Exploit PHP2Shell to Root Firewalls
  • Hackers Start Probing Fresh Oracle EBS Vulnerability
  • Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk

Latest News

  • TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
  • $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
  • When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
  • Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model
  • How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI
  • Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps
  • Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
  • BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts

Trending

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Hackers Start Probing Fresh Oracle EBS Vulnerability

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: Agentic Pentesting for a Stronger CTEM Program

November 4, 2026

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Quantum eMotion has named Wayne Teeple as CTO.

Guy Ellis has been appointed CEO of NCC Group.

Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Context Is King in the Fight Against Modern Cyberattacks

Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)