Skip to content
Critical CVSS 10.0 GitLab Flaw Exploited on Alpine Linux

Critical CVSS 10.0 GitLab Flaw Exploited on Alpine Linux

First seen 31 Oct 2026, 22:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 1, 2026 at 00:14 UTC
  • •CVE-2026-97229 is a critical vulnerability in GitLab with a CVSS score of 10.0.
  • •The flaw allows unauthenticated remote code execution via crafted pipeline settings.
  • •Alpine Linux reported attempts to exploit the vulnerability but found no successful breaches.

A critical vulnerability in GitLab, rated CVSS 10.0, has been against Alpine Linux's GitLab server on October 20 and 21, 2026. The flaw, tracked as CVE-2026-97229, resides in the Onigmo regular expression engine within Ruby, allowing unauthenticated users to execute arbitrary code. The attack involved a newly registered account sending crafted pipeline settings that disrupted GitLab worker processes. Although the attacker attempted to exploit the flaw multiple times, Alpine Linux reported no evidence of successful code execution. CISA added the vulnerability to its KEV list on October 29, 2026, highlighting its status. Organizations running their own GitLab servers are advised to ensure Ruby is patched, as simply updating GitLab is insufficient. The vulnerability was disclosed on October 13, 2026, with a proof-of-concept available the same day.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-13
CVE-2026-97229 published
The vulnerability in the Ruby Onigmo engine was disclosed, allowing remote code execution.
Hsecurities.In
2026-10-20
First attack attempt on Alpine GitLab
An attacker used a newly registered account to send crafted settings to Alpine's GitLab server, causing disruptions.
2-Spyware
2026-10-21
Second attack attempt on Alpine GitLab
The attacker continued attempts to exploit the vulnerability, but the account was blocked on October 23.
2-Spyware
2026-10-29
CISA adds CVE-2026-97229 to KEV list
The US Cybersecurity and Infrastructure Security Agency confirmed the vulnerability's active exploitation status.
2-Spyware

More articles in this cluster (2)

Following this threat?

Track Akira, XMRig and AWS in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (23)

1 / 3

Common questions

Which systems are affected?
GitLab installations running on Alpine Linux are affected, particularly those using Ruby without the latest patches.
What is the current exploitation status?
The vulnerability is actively exploited, confirmed by CISA and reported attempts against Alpine's GitLab.
What should organizations do?
Organizations must ensure their Ruby installations are updated to the patched version to mitigate the risk.