Taiwan Information Security Association
Join TWISA
Menu

Exploitation reportedSat, 31 Oct 2026

GitLab exploit attempts: verify the Ruby patch and review CI credentials

Alpine Linux reported attempts to exploit CVE-2026-97229 against its self-hosted GitLab. For custom packages, verify the Ruby runtime as well as the GitLab version.

Download PDF (Traditional Chinese)View applicable solutionsBack to Security alerts
01

Article

GitLab’s CNA rates CVE-2026-97229 at 10.0 under CVSS v3.1. The flaw affects GitLab CE and EE’s handling of regular-expression compilation in CI/CD. GitLab lists 19.2.8, 19.3.5 and 19.4.2 as fixed releases for their branches. Exposure depends on who can reach the affected CI configuration path.

On October 28, 2026, Alpine Linux reported exploit attempts on October 20 and 21. It found no evidence of code execution, but gaps in logging prevented it from ruling it out. Alpine rebuilt the server and rotated associated credentials. Its own package used a separate Ruby runtime, so upgrading GitLab alone had left the runtime flaw unpatched.

Attack flowHow the attack reaches the service
  1. 01

    Reach the CI path

    The attacker can submit input to the affected CI configuration path on a self-hosted instance.

  2. 02

    Trigger a runtime flaw

    Regular-expression compilation in an affected Ruby runtime can corrupt memory.

  3. 03

    Potential code execution

    Depending on deployment and privileges, code, runners, artifacts and deployment credentials could be affected.

What to do: from the perimeter to internal systems

Response flowResponse steps
  1. 01

    Inventory the development platform

    Include self-hosted, containerized, custom-built and outsourced instances. Record the Ruby and Onigmo versions actually in use.

    See what to doResources: 1

    TWISA member solutions

    Inventory the development platform

    Include self-hosted, containerized, custom-built and outsourced instances. Record the Ruby and Onigmo versions actually in use.

  2. 02

    Apply and verify updates

    Update the GitLab branch and confirm the runtime patch separately for custom packaging.

  3. 03

    Preserve logs and investigate

    Retain application, CI, host and network logs. Review unexpected configuration and jobs, and record any logging gaps.

    See what to doResources: 1

    TWISA member solutions

    Preserve logs and investigate

    Retain application, CI, host and network logs. Review unexpected configuration and jobs, and record any logging gaps.

  4. 04

    Secure delivery credentials

    Review runner and deployment token access. Check artifact integrity and rotate credentials as the investigation warrants.

    See what to doResources: 1

    TWISA member solutions

    Secure delivery credentials

    Review runner and deployment token access. Check artifact integrity and rotate credentials as the investigation warrants.

Defense architectureLayer defenses around self-hosted GitLab

Map GitLab, runners, containers and release pipelines.

Allow authorized traffic and apply controls at each layer.

  1. 01

    Project entry

    GitLab and CI configuration

    Limit accessReview project and configuration permissions.

  2. 02

    Execution environment

    GitLab, Ruby and runners

    Verify patchesConfirm the running runtime and patch level across packaging variants.

  3. 03

    Delivery pipeline

    Tokens, repositories and artifacts

    Review and rotateConfirm credentials are scoped and verify artifacts before reuse.

Feed logs and traffic data from each layer into monitoring and response.

  1. Monitoring and recoveryPreserve CI, host and application logs, and prepare recovery in a trusted environment.

Test and verify

Use authorized asset discovery, vulnerability scans, penetration and API tests, and attack simulation. Retest project permissions, runtime updates, runners and monitoring. Validate any web WAF path separately from runtime, credential and internal-network controls.

TWISA member solutions

Sources and further reading

Alert updated: 2026/10/31. Check the vendor’s latest guidance for product support and patch status.