Alpine Linux Rebuilds GitLab Server Following Attempted RCE Attacks

Alpine Linux has rebuilt its GitLab instance from scratch and reset all passwords following a series of attempted remote code execution (RCE) attacks on its development infrastructure.

The attacks, which occurred between 20 and 21 October, targeted CVE-2026-97229, a maximum-severity vulnerability. While the Alpine Linux team found no evidence that attackers successfully executed code or tampered with software packages, they could not definitively rule out a compromise because essential logs and outbound connection records were unavailable.

Supply Chain Risks and Vulnerability Details

The targeted flaw, CVE-2026-97229, is an integer overflow vulnerability within the Onigmo regular expression compiler bundled with Ruby. In GitLab’s continuous integration and continuous deployment (CI/CD) pipelines, unauthenticated attackers could potentially trigger this flaw by submitting specially crafted regular expressions.

As a lightweight operating system frequently used as the foundation for Docker container images, Alpine Linux represents a significant supply chain target. Any compromise of its GitLab environment, which hosts development repositories, code reviews, and build recipes, could potentially impact downstream software and users globally.

Patching Complications

The incident highlights the technical complexities of managing dependencies in custom environments. Although GitLab released fixes on 12 October, Alpine Linux initially deployed version 19.3.4 instead of the patched 19.3.5. A subsequent attempt to upgrade to version 19.3.6 failed to mitigate the risk because the fix required a specific patch to Ruby, which was missing from Alpine’s custom container image.

During the attacks on 20 and 21 October, attackers submitted malicious CI configurations that caused eight worker crashes, four of which were described as partially successful. The team also noted that attackers had downloaded the Alpine GitLab container image, suggesting preparations for a wider supply-chain attack.

Remediation and Next Steps

Although no tampering with repository commits, packages, or releases has been confirmed, the potential exposure of sensitive data remains a concern. If exploitation had succeeded, information such as user details, password hashes, 2FA secrets, and CI/CD credentials could have been compromised.

The Alpine Linux team advises all users to reset their GitLab passwords. The project has also released a new alpinelinux/gitlab:19.3.6 image, published on 27 October, which includes Ruby 3.3.13 to address the vulnerability.