An attacker attempted to exploit a critical GitLab vulnerability on Alpine Linux's own server, even after a fix was released.
The vulnerability or weakness
The exploit targeted CVE-2026-97229, a critical vulnerability with a CVSS score of 10.0, allowing an attacker to run code through a crafted regular expression in a CI configuration.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-97229 | 10.0 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Linux Flaws Exposed Before Fixes as Root Exploit Goes Public (2026-10-26)
- Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws (2026-10-23) - The Hacker News
- Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes (2026-10-22)
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed (2026-10-22)
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases (2026-10-21)
Business impact
The attack could have significant business impact if successful, potentially leading to unauthorized code execution on the GitLab server, compromising operations and data.
Users affected
Users of Alpine Linux's GitLab server, particularly those running their own Ruby versions, were potentially affected. Alpine's recommendation to rebuild the server and reset passwords highlights the severity for these users.
