Alpine Linux Rebuilds GitLab After RCE Attack Attempt

By PhishPin Threat Research · 2 Nov 2026 · 3 min read

Alpine Linux has rebuilt its GitLab server from scratch and reset every account password after an attacker tried to exploit a maximum-severity GitLab flaw, CVE-2026-97229, on 20 and 21 October.

Alpine says it found no sign that the attacker's code ran, or that packages or releases were changed. But missing logs and records of outgoing connections mean it cannot rule out a compromise, so it chose to rebuild rather than take the risk.

Why Alpine's GitLab server matters

Alpine Linux is a small operating system that many projects use as the base for Docker container images. Its GitLab server handles code review, repositories and build pipelines, including the aports recipes used to build Alpine's software packages. That makes it an attractive target for anyone planning a supply chain attack on the systems that depend on Alpine.

The flaw, and why patching was not enough

CVE-2026-97229 has the top severity score of 10.0. It is an integer overflow in Onigmo, the regular expression engine inside Ruby, which GitLab uses to process CI/CD configuration files. An attacker with no account can submit a crafted expression in a pipeline file and run code on the server.

GitLab had already released fixes. According to Alpine's account, it upgraded on 13 October, but to version 19.3.4 instead of the patched 19.3.5, which it later called a mistake. It moved to 19.3.6 on 22 October, yet the server stayed vulnerable. The fix is a patch to Ruby itself, shipped inside GitLab's official packages, and Alpine's custom container used standard Ruby without it.

What Alpine found and did

• Crafted pipeline files crashed GitLab worker processes eight times over 20 and 21 October. Four attempts got past the first stage before failing at the next.
• The attacker also downloaded Alpine's GitLab container image, which Alpine says suggests the exploit was being tuned to that exact build.
• Alpine's checks of repositories, packages and releases found no tampering. They covered the period to 24 October and were being extended to 27 October.
• Alpine rebuilt the server, reset all passwords and kept public logins closed while it ran further checks.
• On 27 October it republished the alpinelinux/gitlab:19.3.6 image, now built with Ruby 3.3.13.

CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalogue on 29 October, according to reports.

What GitLab administrators should do

Update to a fixed GitLab release for your branch; reports list 19.4.2, 19.3.5 and 19.2.8, so check GitLab's advisory for your version. If you build GitLab yourself or run a custom container image, also check that the Ruby runtime carries the fix, because upgrading GitLab alone did not protect Alpine.

Alpine's case also shows the cost of thin logging. Keep application logs and records of outgoing connections, and look for unexplained worker crashes around 20 October onwards. Without that evidence, a rebuild may be the only safe answer.

Frequently asked questions

Sources

• BleepingComputer · 1 Nov 2026
• StartupHub · 2 Nov 2026
• Tech Insider · 2 Nov 2026
• Red Secure Tech · 2 Nov 2026

PhishPin writes its own analysis from the facts in this reporting and links to the original coverage.