Attempted Exploitation of Critical GitLab Flaw on Alpine Linux Server

• •An attacker attempted to exploit CVE-2026-97229 on Alpine Linux's GitLab server.
• •The vulnerability has a CVSS score of 10.0 and allows remote code execution.
• •Alpine Linux rebuilt its server and reset all passwords as a precaution.

On October 20 and 21, an attacker attempted to exploit a critical GitLab vulnerability (CVE-2026-97229) on the Alpine Linux project's GitLab server, just a week after GitLab released a fix. The flaw, which has a CVSS score of 10.0, allows for remote code execution through crafted CI configurations. Although Alpine Linux found no evidence that the attack was successful, they could not rule it out, prompting them to rebuild the server from scratch and reset all user passwords. The attacker used a newly registered account to probe the server, causing crashes and downloading the GitLab container image, suggesting they were tuning the exploit. Alpine's server was still running an outdated version of GitLab (19.3.4) at the time of the attack, and an upgrade to 19.3.6 on October 22 did not mitigate the vulnerability due to the use of standard Ruby instead of the patched version. Alpine has since implemented additional security measures and is currently testing the rebuilt server before reopening it to the public.