CVE-2026-97229: Attacker Attempted Exploitation of GitLab on Alpine Linux

# CVE-2026-97229: Attacker Attempted Exploitation of GitLab on Alpine Linux

https://gcdradar.vercel.app/incidents/cve-2026-97229-attacker-attempted-exploitation-of-gitlab-on · AIR-2026-1634 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Exploitation attempt against a real server using a critical flaw.
- Fix status: Patched
- First reported: 2026-10-29 (happened 2026-10-28)
- AI role: No AI role
- Products: GitLab
- CVE ids: CVE-2026-97229
- CVSS: 10

## Summary

An attacker attempted to exploit a CVSS 10.0 remote code execution flaw in GitLab on Alpine Linux's server. Alpine reported no evidence of successful compromise following the attack.

## What to do

Update GitLab to the latest patched version.

## Affected and fixed versions

- Affected: GitLab

## Latest updates

- 2026-11-01: Project rebuilds GitLab server and resets all passwords following attempted exploitation (https://bleepingcomputer.com/news/security/alpine-linux-rebuilds-gitlab-after-attempted-rce-attack)
- 2026-10-29: Added to the CISA KEV catalog (exploitation confirmed) (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229)
- 2026-10-29: Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open (https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html)

## Sources

- 2026-10-29 The Hacker News: Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html
- 2026-10-29 CISA: CVE-2026-97229: GitLab Community Edition and Enterprise Edition — GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229
- 2026-10-30 SecurityWeek: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux https://securityweek.com/max-severity-gitlab-vulnerability-exploited-against-alpine-linux
- 2026-10-30 The Hacker News: CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html
- 2026-10-30 BleepingComputer: CISA says max severity GitLab flaw now exploited in the wild https://bleepingcomputer.com/news/security/hackers-now-exploiting-max-severity-gitlab-flaw-in-attacks
- 2026-11-01 BleepingComputer: Alpine Linux rebuilds GitLab after attempted RCE attack https://bleepingcomputer.com/news/security/alpine-linux-rebuilds-gitlab-after-attempted-rce-attack
- 2026-11-02 BleepingComputer: Over 1,000 GitLab servers vulnerable to ongoing RCE attacks https://bleepingcomputer.com/news/security/over-1-000-gitlab-servers-vulnerable-to-code-execution-attacks

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.