Between October 20 and 21, threat actors launched a series of attacks against Alpine Linux's development infrastructure, attempting to exploit a critical vulnerability in the project's GitLab deployment. Concerned about the possibility of unauthorized access, Alpine Linux chose to completely rebuild its GitLab instance and invalidate all user passwords as a precautionary measure.
The exploitation attempts centered on CVE-2026-97229, a maximum-severity remote code execution vulnerability residing in GitLab's CI/CD regular expression compiler Onigmo, which is bundled as part of Ruby. The attackers repeatedly triggered crashes in GitLab worker processes, with several attempts coming close to achieving their objectives.
Despite conducting a thorough investigation, Alpine Linux discovered no definitive proof that attackers successfully executed code or modified any software packages or releases. However, the absence of comprehensive logging and outbound connection records prevented the team from completely ruling out a successful breach.
Because we cannot rule out code execution, and the evidence we would need to confirm it no longer exists, we took the harder route and rebuilt the GitLab instance from scratch
Alpine Linux team
Why Alpine Linux's GitLab Matters
Alpine Linux serves as a minimal, efficient operating system frequently deployed as the base layer for Docker container images used across countless applications and services. The project's GitLab server functions as the central hub for development repositories, code review workflows, and continuous integration jobs, including the "aports" build recipes that generate Alpine's complete software package catalog.
This infrastructure represents a high-value target within the software supply chain. A successful compromise of the GitLab environment could potentially allow attackers to inject malicious code into packages distributed to downstream users and organizations.
The Vulnerability and Patch Timeline
CVE-2026-97229 is an integer overflow flaw in Onigmo, the regular expression compiler used by GitLab's CI/CD system. Unauthenticated attackers can trigger the vulnerability by submitting a specially crafted regular expression within a CI/CD pipeline configuration file, potentially leading to arbitrary code execution on the affected server.
GitLab released information about the flaw and made patches available on October 12. Alpine Linux initially deployed GitLab version 19.3.4, which lacked the fix. The team later upgraded to 19.3.5 and subsequently 19.3.6, but the latter update failed to fully address the vulnerability because the necessary patch required modifications to Ruby itself—a component that GitLab included in its official container packages but Alpine's custom image did not.
Attack Details and Investigation Findings
During the October 20-21 window, the attacker submitted malicious CI configurations designed to exploit the flaw, resulting in eight worker process crashes. Four of these crashes showed signs of partial success, though none appeared to achieve full code execution.
Investigators determined that the threat actor had downloaded Alpine Linux's GitLab container image, indicating possible preparation for a broader supply-chain attack. Following the incident investigation through October 27, Alpine Linux found no evidence of tampering in repository commits, software packages, or published releases. The team also confirmed that cryptographic signing keys, which are not stored on the GitLab server, remained secure.
If the attackers had successfully executed code, potentially compromised data could have included user account information, password hashes, two-factor authentication secrets, CI/CD credentials, integration tokens, and private project repositories. Alpine Linux has not confirmed any actual compromise of these assets.
Recommended Actions
Alpine Linux is directing all users to reset their GitLab passwords immediately. The project also recommends pulling the updated alpinelinux/gitlab:19.3.6 container image published on October 27, which includes Ruby 3.3.13 and fully resolves CVE-2026-97229.