GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux

Small. Simple. Secure. Alpine Linux is a security-oriented, lightweight Linux distribution based on musl libc and busybox. 2026-10-28 GitLab security incident: attempted exploitation of CVE-2026-97229 On October 20 and 21, an attacker tried to exploit a GitLab vulnerability (CVE-2026-97229) on our instance, a week after the fix was released. The attack came close to working. We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with. GitLab is being tested before we open it to the public again. All passwords have been reset, so when it is back you will need to set a new one with “Forgot your password?” on the sign-in page. We will post exactly what you need to do when it reopens. In the meantime: if you used the same password for your gitlab.alpinelinux.org account anywhere else, change it there. We have seen automated login attempts against our GitLab with passwords leaked from other sites. If you have questions or concerns please reach out to us at infra@alpinelinux.org.

小巧、简洁、安全。Alpine Linux 是一个基于 musl libc 和 busybox 的轻量级、以安全为导向的 Linux 发行版。2026 年 10 月 28 日 GitLab 安全事件：CVE-2026-97229 漏洞利用尝试。10 月 20 日和 21 日，一名攻击者试图在我们的实例上利用 GitLab 漏洞（CVE-2026-97229），此时距离修复补丁发布已过去一周。攻击非常接近成功。我们尚未发现任何成功的证据，但无法排除这种可能性，因此我们将该实例视为已遭入侵，并从零开始进行了重建。我们的检查显示，aports 仓库、软件包以及 10 月 21 日的发布版本均未被篡改。在重新向公众开放之前，GitLab 正在接受测试。所有密码均已重置，因此当系统恢复时，您需要在登录页面使用“忘记密码？”功能设置新密码。我们将在系统重新开放时发布具体操作指南。在此期间：如果您在其他任何地方使用了与 gitlab.alpinelinux.org 相同的密码，请立即更改。我们已经观察到针对我们 GitLab 的自动化登录尝试，这些尝试使用了从其他网站泄露的密码。如果您有任何疑问或顾虑，请通过 infra@alpinelinux.org 与我们联系。

What happened The vulnerability: CVE-2026-97229 is a critical (CVSS 10.0) vulnerability in how GitLab evaluates regular expressions in CI configuration. The underlying bug is in Onigmo, the regular expression engine built into Ruby. GitLab published fixed releases on October 12, but the fix itself is a set of patches to the Ruby that GitLab bundles in its own packages and container images. Upstream Ruby shipped the fix on October 23, in Ruby 3.3.13, 3.4.12 and 4.0.9. The attack: On October 20 and 21, a newly registered account sent crafted CI configurations to our GitLab instance, which was still running 19.3.4 and did not have the October 12 fix. This crashed GitLab worker processes 8 times. In 4 of those crashes the attacker got partway through the exploit and failed at the next step. The attacker also downloaded our GitLab container image, which suggests they were tuning the exploit to our exact build. We have found no evidence that the attacker ran code on the server, but we cannot rule it out.

发生了什么：该漏洞 CVE-2026-97229 是一个严重级别（CVSS 10.0）的漏洞，涉及 GitLab 如何在 CI 配置中评估正则表达式。根本原因在于 Ruby 内置的正则表达式引擎 Onigmo。GitLab 于 10 月 12 日发布了修复版本，但修复本身是一组针对 GitLab 在其软件包和容器镜像中捆绑的 Ruby 的补丁。上游 Ruby 于 10 月 23 日在 Ruby 3.3.13、3.4.12 和 4.0.9 版本中发布了修复程序。攻击过程：10 月 20 日和 21 日，一个新注册的账户向我们的 GitLab 实例发送了精心构造的 CI 配置，该实例当时仍在运行 19.3.4 版本，尚未应用 10 月 12 日的修复。这导致 GitLab 工作进程崩溃了 8 次。在其中 4 次崩溃中，攻击者完成了部分利用过程，但在下一步失败了。攻击者还下载了我们的 GitLab 容器镜像，这表明他们正在针对我们的具体构建版本调整攻击手段。我们尚未发现攻击者在服务器上运行代码的证据，但无法排除这种可能性。

Our upgrade didn’t fix the vulnerability: Upgrading to GitLab 19.3.6 on October 22 didn’t fix the vulnerability. The fix isn’t in GitLab’s own code but in a patch to Ruby, which GitLab applies only in its official packages. Our image used standard Ruby, so it didn’t get the patch. If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later. If you use our alpinelinux/gitlab container image, pull alpinelinux/gitlab:19.3.6 again. The image published on October 27 contains Ruby 3.3.13. Any 19.3.6 image you pulled before October 27, and all older tags, are vulnerable.

我们的升级并未修复该漏洞：10 月 22 日升级到 GitLab 19.3.6 并未修复该漏洞。修复不在 GitLab 自身的代码中，而是在 Ruby 的补丁中，GitLab 仅在其官方软件包中应用此补丁。我们的镜像使用的是标准 Ruby，因此没有获得该补丁。如果您运行的是使用自备 Ruby（从源码编译或在您自己的容器镜像中）而非 GitLab 官方软件包的 GitLab，那么仅升级 GitLab 是不够的：您还需要 Ruby 3.3.13、3.4.12、4.0.9 或更高版本。如果您使用我们的 alpinelinux/gitlab 容器镜像，请重新拉取 alpinelinux/gitlab:19.3.6。10 月 27 日发布的镜像包含 Ruby 3.3.13。任何在 10 月 27 日之前拉取的 19.3.6 镜像以及所有旧标签版本均存在漏洞。