{"id":"CMP-202610-attackers-try-gitlab-ci-regex-rce-cve-2026-97229-on-self-hos","kind":"campaign","aliases":[],"related":["CVE-2026-97229"],"title":"Attackers try GitLab CI regex RCE (CVE-2026-97229) on self-hosted GitLab; upgrading GitLab does not fix installs that use their own Ruby","description":null,"summary":"Alpine Linux reports that on 20-21 Oct 2026 a newly registered account sent crafted CI configurations to its self-hosted GitLab (19.3.4, unpatched) to exploit CVE-2026-97229, a CVSS 10.0 bug in Ruby's Onigmo regex engine reached through GitLab's CI config regex evaluation. Worker processes crashed 8 times, 4 times partway through the exploit. The attacker downloaded Alpine's GitLab container image to tune the exploit to that build and came back on 25-26 Oct. Alpine found no proof of code execution but could not rule it out, so it rebuilt the instance and reset all passwords and secret keys. The catch: GitLab's fix (released 12 Oct) is a patch to the Ruby bundled in its official packages and images. GitLab built from source or in custom images on standard Ruby stays exploitable after upgrading GitLab (Alpine was still exposed on 19.3.6) until Ruby is 3.3.13, 3.4.12, 4.0.9 or later (released 23 Oct). Any Ruby program that compiles regexes from untrusted input is also exposed. Anyone who lets the public register accounts on a self-hosted GitLab is at risk. Who is behind it is unknown, and so is whether other instances were hit.","severity":"critical","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-28T23:59:17+00:00","products":[{"name":"GitLab","fixed":[],"affected":"self-managed installs without the 12 Oct 2026 fix, and source or custom-image installs on Ruby < 3.3.13 / 3.4.12 / 4.0.9","ecosystem":"self-hosted"},{"name":"Ruby","fixed":["3.3.13","3.4.12","4.0.9"],"affected":"< 3.3.13, 3.4.x < 3.4.12, 4.0.x < 4.0.9","ecosystem":"runtime"}],"ecosystems":[],"tags":["campaign","early-warning","gitlab","ruby","self-hosted"],"not_affected_if":[],"how_to_check":"Check the GitLab version (gitlab-rake gitlab:env:info) and how it was installed. Official Omnibus packages and GitLab images on the fixed release line carry the patched Ruby. For source installs or custom or third-party images (including alpinelinux/gitlab tags pulled before 27 Oct), run 'ruby -v' inside the GitLab runtime: below 3.3.13, 3.4.12 or 4.0.9 means it is vulnerable. Look for repeated GitLab worker crashes or 502s around CI config submissions, and newly registered accounts pushing unusual .gitlab-ci.yml content. No network indicators were published (unknown).","fix":"Upgrade GitLab to a fixed release (official packages are fixed from 12 Oct). If you run GitLab on your own Ruby, also upgrade Ruby to 3.3.13, 3.4.12, 4.0.9 or later. On Alpine, run apk upgrade, or pull alpinelinux/gitlab:19.3.6 again (rebuilt 27 Oct). Until patched, close open sign-ups. If you were exposed while unpatched with open registration, treat the instance as possibly compromised: rotate CI/CD variables, runner tokens, webhook, integration and mirror credentials, personal access tokens and 2FA secrets, and reset passwords. Also apply Ruby updates to other Ruby apps that compile untrusted regexes.","status":"open","published_at":"2026-10-28T00:00:00+00:00","first_seen_at":"2026-10-28T23:59:17+00:00","triaged_at":"2026-10-28T23:59:17+00:00","updated_at":"2026-10-28T23:59:17+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-2026':8A,81B '-202610':27A '-21':59B '-26':132B '-97229':9A,37A,82B '10.0':85B '12':165B '19.3.4':76B '19.3.6':201B '20':58B '2026':36A,61B '23':211B '25':131B '3.3.13':205B '3.4.12':206B '4':106B '4.0.9':207B '8':104B 'account':65B,231B 'alpin':53B,115B,134B,196B 'also':223B 'anyon':225B 'attack':1A,113B 'attackers':29A 'attackers-try-gitlab-ci-regex-rce-cve':28A 'back':129B 'behind':243B 'bug':86B 'build':126B 'built':181B 'bundl':173B 'came':128B 'campaign':44B 'catch':160B 'ci':4A,32A,68B,97B 'cmp':26A 'code':139B 'compil':217B 'config':98B 'configur':69B 'contain':118B 'could':142B 'craft':67B 'crash':103B 'custom':186B 'cve':7A,35A,80B 'cvss':84B 'download':114B 'earli':46B 'early-warn':45B 'engin':92B 'evalu':100B 'execut':140B 'exploit':79B,111B,123B,192B 'expos':199B,224B 'fix':19A,163B 'found':135B 'gitlab':3A,14A,16A,31A,42A,48B,75B,95B,117B,161B,180B,195B,237B 'hit':254B 'hos':41A 'host':13A,52B,74B,236B 'imag':119B,179B,187B 'input':221B 'instal':20A 'instanc':151B,252B 'key':158B 'later':209B 'let':227B 'linux':54B 'newli':63B 'oct':60B,133B,166B,212B 'offici':176B 'on':39A 'on-self-hos':38A 'onigmo':90B 'packag':177B 'partway':108B 'password':155B 'patch':169B 'process':102B 'program':215B 'proof':137B 'public':229B 'rce':6A,34A 'reach':93B 'rebuilt':149B 'regex':5A,33A,91B,99B,218B 'regist':64B,230B 'releas':164B,210B 'report':55B 'reset':153B 'risk':240B 'rubi':25A,49B,88B,172B,190B,203B,214B 'ruby':43A 'rule':144B 'secret':157B 'self':12A,40A,51B,73B,235B 'self-host':11A,50B,72B,234B 'sent':66B 'sourc':183B 'standard':189B 'stay':191B 'still':198B 'time':105B,107B 'tri':2A 'try':30A 'tune':121B 'unknown':246B 'unpatch':77B 'untrust':220B 'upgrad':15A,194B 'use':22A 'warn':47B 'whether':250B 'worker':101B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-attackers-try-gitlab-ci-regex-rce-cve-2026-97229-on-self-hos","url":null,"severity":null,"published_at":"2026-10-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-28T23:59:17+00:00","fetched_at":"2026-10-28T23:59:17+00:00","note":null}],"documents":[{"id":13067,"url":"https://news.ycombinator.com/item?id=50282544","title":"GitLab Security Incident: Attempted Exploitation of CVE-2026-97229","kind":"post","source":"hackernews","text":"GitLab Security Incident: Attempted Exploitation of CVE-2026-97229\nhttps://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-28T23:45:46+00:00","relation":"describes","confidence":null,"note":null},{"id":13072,"url":"https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html","title":"GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux","kind":"advisory","source":"analyst","text":"Alpine Linux: on Oct 20-21 2026 a newly registered account sent crafted CI configurations to gitlab.alpinelinux.org (GitLab 19.3.4, unpatched) to exploit CVE-2026-97229 (CVSS 10, Onigmo regex engine in Ruby, GitLab CI config regex evaluation). 8 worker crashes, 4 partial exploit progress; attacker downloaded Alpine's GitLab container image to tune the exploit; returned Oct 25-26. No evidence of code execution but cannot rule out; instance rebuilt, all passwords and secret keys reset. GitLab fixed releases Oct 12 (fix is patches to bundled Ruby, only in official omnibus packages/images). Upgrading to 19.3.6 with standard Ruby did NOT fix it. Ruby fix: 3.3.13, 3.4.12, 4.0.9 (Oct 23). alpinelinux/gitlab:19.3.6 image re-published Oct 27 with Ruby 3.3.13; earlier pulls and older tags vulnerable. Aports, packages and Oct 21 releases verified untampered; signing keys not on GitLab. Automated credential-stuffing logins seen too.","published_at":"2026-10-28T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}