Alpine Linux Rebuilt Its Code Server From Scratch and Reset Every Password

Alpine Linux has rebuilt its GitLab server from scratch and reset every account password, two-factor secret and access token, after what the project describes as an attempted exploitation of CVE-2026-97229. The project said the attempt was made on Oct. 20 and 21, 2026. It found no evidence that the attempt succeeded, cannot rule it out, and so treated the server as compromised.

The project's own first response did not work. It said that upgrading to GitLab 19.3.6 did not close the flaw, because the fix is a patch to the Ruby that GitLab ships inside its official packages rather than a change to GitLab's code. Alpine's container image used standard Ruby, so it never got the patch. The project said that anyone running GitLab on their own Ruby needs Ruby 3.3.13, 3.4.12 or 4.0.9 as well as the GitLab update.

In a disclosure dated Oct. 28, 2026, the project called the flaw critical, put its severity at CVSS 10.0, and said the underlying bug sits in the regular expression engine built into Ruby. It said that the attempt came close to working, and that it rebuilt the server because the evidence needed to settle whether any code ran no longer exists. GitLab's secret keys were replaced along with the credentials.

The project said it found no sign of tampering in the aports source repository, in the packages built from Oct. 20 to 24, 2026, or in the stable releases issued Oct. 21, 2026, each of which it checked against records kept outside GitLab. It also said the keys that sign Alpine packages and releases are not kept on that server and never have been.

The server is open again on GitLab 19.3.7 with a Ruby that carries the fix. A second post tells account holders to set a new password and register two-factor authentication again, and project maintainers to re-enter their continuous integration variable values and replace webhook and integration secrets.