VULNpocalypse
CriticalVulnerabilityActive

Max-severity GitLab RCE CVE-2026-97229 exploited against Alpine Linux, upgrading GitLab alone may not fix it

A CVSS 10 GitLab code execution flaw in Ruby’s Onigmo engine was used against Alpine Linux and is on CISA’s KEV list, and a GitLab upgrade alone may not fix it.

Published
Updated
Fixed in
GitLab 19.4.2, 19.3.5, 19.2.8 or later (newest 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13), plus Ruby 3.3.13, 3.4.12, 4.0.9 or later for self-compiled installs and images with their own Ruby
Exploitation
Yes, CISA added CVE-2026-97229 to its KEV catalog and Alpine Linux reported an attempted exploit on 20 and 21 October, with code execution neither confirmed nor ruled out

Live scores

CVE-2026-97229
EPSS
0.652
very likely to be attacked soon
VEDAS
0.982
strong exploit evidence
On CISA KEV
Yes, since 2026-10-29
Detection rule
None yet
EPSS (chance of attack)
100.1Added to CISA KEV 2026-10-29CVE-2026-97229 EPSS over time2026-102026-11-04
VEDAS (exploit evidence)
100.5Added to CISA KEV 2026-10-29CVE-2026-97229 VEDAS over time2026-102026-11-04

Thin horizontal line: the “likely exploited” threshold (EPSS 0.10, VEDAS 0.5). Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

VEDAS flagged this bug about 8 days before CISA confirmed attacks.

Live scores

CVE-2026-110264
EPSS
0.013
some chance of attack soon
VEDAS
0.983
strong exploit evidence
On CISA KEV
Not listed
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-110264 EPSS over time2026-102026-11-04
VEDAS (exploit evidence)
100.5CVE-2026-110264 VEDAS over time2026-102026-11-04

Thin horizontal line: the “likely exploited” threshold (EPSS 0.10, VEDAS 0.5). Shaded “no data” areas are periods when cve-scores did not publish.

What happened

CVE-2026-97229 (CVSS 10) is an integer overflow in Onigmo, the regular expression engine built into Ruby. GitLab’s advisory says that under certain conditions it could let an unauthenticated user run arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. GitLab published its advisory on 12 October SecurityWeek BleepingComputer.

Alpine Linux reported that an attacker used a newly registered account to send crafted CI configurations to its GitLab server on 20 and 21 October. These crashed GitLab worker processes 8 times. In 4 of those crashes the attacker got partway through the exploit and failed at the next step. The attacker also downloaded Alpine’s GitLab container image, which Alpine said suggests they were tuning the exploit to its exact build The Hacker News.

Alpine found no evidence that the attacker ran code, but could not rule it out because some logs are gone and outbound connections were not logged. It rebuilt the server from scratch, reset all passwords and replaced GitLab’s secret keys The Hacker News. Alpine says its checks show the aports repository, packages and the 21 October releases were not tampered with, and its signing keys were never on the GitLab server SecurityWeek The Hacker News.

Why the upgrade did not help Alpine: the bug is in Ruby, not in GitLab code. GitLab’s 12 October fix patched the Ruby shipped inside its Linux packages and official container images. Alpine’s image used standard Ruby, so moving to GitLab 19.3.6 on 22 October left it vulnerable. Alpine had also mistakenly installed 19.3.4 instead of 19.3.5 on 13 October The Hacker News BleepingComputer. Ruby’s own fixed versions came out on 22 and 23 October. The Hacker News reported that, as of 29 October, GitLab’s patch release posts for 12 and 21 October did not tell self-compiled administrators to update Ruby The Hacker News.

Exploitation status: CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on Thursday, after The Hacker News noted it was not listed as of the 28 October catalog update. CISA gave federal agencies a short deadline under BOD 26-04 and encouraged private sector teams to prioritize it BleepingComputer SecurityWeek. Shadowserver tracks nearly 2,800 internet-exposed GitLab Community Edition instances, and it is not confirmed how many are patched BleepingComputer.

Rapid7 built a working exploit in a lab and published proof-of-concept code on 13 October. It ran commands as the git user on an unpatched official GitLab 19.4.1 image but not on the patched 19.4.2 image. Its route needs write access first, meaning a malicious .gitlab-ci.yml and a UTF-8 file path committed to a branch of a public project. That requirement does not apply where new users can register and create projects. Rapid7 does not yet know how the original report to GitLab avoids the write step The Hacker News. How Alpine’s attacker delivered its CI configurations is not confirmed.

A separate flaw, CVE-2026-110264, is also a CVSS 10 regular expression compiler bug in GitLab. GitLab fixed it in its 21 October releases, and it affects GitLab CE and EE from 7.0 before the fixed versions listed in this advisory CERT-EU The Register. The Register said on 22 October that there was no indication yet of in-the-wild exploitation of that one The Register.

Am I affected?

You are likely affected if you run self-managed GitLab CE or EE. GitLab.com and GitLab Dedicated are already patched The Hacker News.

Per GitLab’s advisory as summarized by The Hacker News, CVE-2026-97229 is fixed in these releases:

  • 19.4 branch: 19.4.2
  • 19.3 branch: 19.3.5, and 19.3.4 is now listed as affected
  • 19.2 branch: 19.2.8
  • 19.5, 19.1, 19.0 and 18.11: not listed as affected

The Hacker News BleepingComputer

How you install GitLab matters:

  • GitLab Linux package or official container images: the newest release for your branch carries the patched Ruby.
  • Self-compiled installs, or images that install their own Ruby: upgrading GitLab is not enough. You need Ruby 3.3.13, 3.4.12, 4.0.9 or later. Ruby 3.2 reached end of life in April and will get no fix The Hacker News.
  • alpinelinux/gitlab image: any 19.3.6 image pulled before 27 October, and every older tag, is vulnerable The Hacker News.

For CVE-2026-110264, affected versions run from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1 CERT-EU.

If you hold an account on gitlab.alpinelinux.org, you will need to set a new password when it reopens. Alpine also saw automated login attempts using passwords leaked elsewhere The Hacker News.

What to do now

  1. Upgrade GitLab to the newest release on your branch: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. These also fix CVE-2026-110264 The Hacker News CERT-EU. Prioritize internet-facing servers CERT-EU.
  2. If you compile GitLab from source or use a container image with its own Ruby, update Ruby to 3.3.13, 3.4.12, 4.0.9 or later. Move off Ruby 3.2 The Hacker News.
  3. If you use the alpinelinux/gitlab image, pull alpinelinux/gitlab:19.3.6 again. The image published on 27 October contains Ruby 3.3.13. On Alpine hosts, run apk upgrade to get Ruby 3.4.12 (Alpine 3.22, 3.23, 3.24, edge) or 3.3.13 (Alpine 3.21) The Hacker News.
  4. If you cannot upgrade right away, Rapid7 suggests restricting anonymous access to public projects, stopping untrusted users from creating or writing to public projects, or blocking the CI lint route. These cover only Rapid7’s exploit route and do not fix the vulnerable compiler The Hacker News.
  5. Hunt for exploitation. GitLab published six Sigma detection rules for self-managed servers, four marked experimental. Look for files owned by the git user in /tmp, unexpected child processes of Puma or Sidekiq, outbound connections, and changed crontabs or SSH keys for the git user. A successful exploit can leave no crash and no trace in web logs The Hacker News. CERT-EU also points to two GitLab detection rules for CVE-2026-110264 CERT-EU.
  6. If you see signs of code execution, treat the server as compromised. Rotate the secrets in gitlab-secrets.json, all CI/CD variables, all runner tokens and all access tokens. Limit who can create accounts and personal access tokens The Hacker News.
  7. Federal agencies should treat the CISA KEV deadline under BOD 26-04 as binding. Everyone else should treat it as a priority signal BleepingComputer.

Sources