Alpine Linux Rebuilds GitLab After RCE Attack Attempts

Alpine Linux rebuilt its GitLab server and reset all user passwords after attackers targeted a critical vulnerability on October 20–21. Although investigators found no evidence of successful code execution, missing logs prevented them from ruling out a compromise.

Attackers Target Alpine Linux Development Infrastructure

The attacks focused on CVE-2026-97229, a maximum-severity remote code execution vulnerability affecting GitLab. The flaw involves an integer overflow in Onigmo, a regular expression engine bundled with Ruby. Under certain conditions, unauthenticated attackers could exploit it through specially crafted CI/CD pipeline configurations.

GitLab disclosed the vulnerability and released fixes on October 12. However, Alpine initially installed version 19.3.4 instead of the patched 19.3.5 release. A subsequent upgrade to version 19.3.6 also left its deployment vulnerable because the underlying Ruby component still needed a patch.

GitLab included that Ruby correction in its official packages. However, Alpine’s custom container image lacked the necessary change. As a result, updating GitLab alone did not remove the vulnerability from the project’s environment.

Malicious Pipeline Configurations Trigger Eight Crashes

During the October attacks, malicious CI configurations caused eight worker process crashes. Investigators described four attempts as partially successful, although they found no evidence that any achieved full code execution. Nevertheless, the available records could not conclusively establish that every attempt failed.

The investigation also revealed that the attackers downloaded Alpine’s GitLab container image. This suggested they may have studied the deployment while preparing a potential supply-chain attack. However, downloading the image did not establish that they successfully compromised the server.

Missing logs and the absence of outbound connection records limited the investigation. Consequently, the team rebuilt the GitLab instance from scratch rather than relying on an environment it could no longer fully verify.

No Evidence of Package or Release Tampering

Alpine Linux provides a lightweight operating system that commonly serves as the foundation for Docker container images. Its GitLab infrastructure hosts development repositories, code reviews and automated CI jobs. It also contains the aports build recipes used to produce software packages.

That role makes the development platform an attractive target for attackers seeking access to downstream software. However, Alpine’s investigation found no evidence of changes to repository commits, packages or releases through October 27. The team also confirmed that the GitLab server did not store package-signing keys, keeping those keys outside the potential exposure.

If attackers achieved code execution, they could potentially have accessed user information, password hashes and two-factor authentication secrets. Other potentially exposed material includes CI/CD secrets, integration credentials and private project content. However, investigators have not confirmed access to any of this information.

Corrected Container Image Includes the Ruby Fix

Following the rebuild, Alpine Linux advised GitLab users to reset their passwords. It also directed users of its GitLab container to obtain the alpinelinux/gitlab:19.3.6 image published on October 27. That image includes Ruby 3.3.13 and addresses the vulnerability.

The incident highlights why dependency fixes matter alongside application updates. In this case, the GitLab version number alone did not establish protection. The custom deployment also needed the corrected Ruby component to close the security gap.