GoKawiilAlpine Linux's GitLab instance targeted by attempted CVE-2026-97229 exploit
Alpine Linux said an attacker tried to exploit a critical GitLab vulnerability (CVE-2026-97229, CVSS 10.0) against its gitlab.alpinelinux.org instance on October 20-21, a week after a fix was released but before the instance was patched. The attempts crashed worker processes eight times and came close to succeeding, though the team found no confirmed evidence of a successful breach. As a precaution, the instance was rebuilt from scratch, all user passwords were reset, and the service is being tested before reopening to the public.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights a gap between when vendors publish patches and when they are actually deployed, a window attackers can exploit, as GitLab's October 12 fix relied on an upstream Ruby/Onigmo patch not released until October 23. Alpine's note that the attacker downloaded its container image suggests, in the team's view, an effort to tailor the exploit to their specific build. The warning about credential-stuffing attempts also points to a broader risk for users who reuse passwords across services.
- Attackers attempted to exploit CVE-2026-97229 against Alpine Linux's GitLab instance on Oct 20-21, before it was patched.
- No confirmed compromise was found, but Alpine rebuilt the instance and reset all passwords as a precaution.
- Users are urged to change reused passwords elsewhere, as credential-stuffing login attempts have been observed against the GitLab instance.
YubiKey 5C NFC Security Key — After a password-reset event like this, hardware-based two-factor authentication is one of the best ways to lock down your GitLab and other developer accounts. The YubiKey 5C NFC lets you require physical confirmation for logins, making stolen or leaked passwords far less useful to attackers. It's a simple, durable way to add real security to accounts tied to your infrastructure work.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: alpinelinux.org, 2026-10-28
Published there as: “GitLab Security Incident: Attempted Exploitation of CVE-2026-97229”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.