---
id: "CMP-202610-attackers-try-gitlab-ci-regex-rce-cve-2026-97229-on-self-hos"
kind: "campaign"
aliases: []
title: "Attackers try GitLab CI regex RCE (CVE-2026-97229) on self-hosted GitLab; upgrading GitLab does not fix installs that use their own Ruby"
severity: "critical"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "GitLab", "fixed": [], "affected": "self-managed installs without the 12 Oct 2026 fix, and source or custom-image installs on Ruby < 3.3.13 / 3.4.12 / 4.0.9", "ecosystem": "self-hosted"}, {"name": "Ruby", "fixed": ["3.3.13", "3.4.12", "4.0.9"], "affected": "< 3.3.13, 3.4.x < 3.4.12, 4.0.x < 4.0.9", "ecosystem": "runtime"}]
ecosystems: []
tags: ["campaign", "early-warning", "gitlab", "ruby", "self-hosted"]
not_affected_if: []
published_at: "2026-10-28T00:00:00+00:00"
first_seen_at: "2026-10-28T23:59:17+00:00"
updated_at: "2026-10-28T23:59:17+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-28T23:59:17+00:00"}]
---

# Attackers try GitLab CI regex RCE (CVE-2026-97229) on self-hosted GitLab; upgrading GitLab does not fix installs that use their own Ruby

Alpine Linux reports that on 20-21 Oct 2026 a newly registered account sent crafted CI configurations to its self-hosted GitLab (19.3.4, unpatched) to exploit CVE-2026-97229, a CVSS 10.0 bug in Ruby's Onigmo regex engine reached through GitLab's CI config regex evaluation. Worker processes crashed 8 times, 4 times partway through the exploit. The attacker downloaded Alpine's GitLab container image to tune the exploit to that build and came back on 25-26 Oct. Alpine found no proof of code execution but could not rule it out, so it rebuilt the instance and reset all passwords and secret keys. The catch: GitLab's fix (released 12 Oct) is a patch to the Ruby bundled in its official packages and images. GitLab built from source or in custom images on standard Ruby stays exploitable after upgrading GitLab (Alpine was still exposed on 19.3.6) until Ruby is 3.3.13, 3.4.12, 4.0.9 or later (released 23 Oct). Any Ruby program that compiles regexes from untrusted input is also exposed. Anyone who lets the public register accounts on a self-hosted GitLab is at risk. Who is behind it is unknown, and so is whether other instances were hit.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- self-hosted:GitLab affected self-managed installs without the 12 Oct 2026 fix, and source or custom-image installs on Ruby < 3.3.13 / 3.4.12 / 4.0.9 fixed ?
- runtime:Ruby affected < 3.3.13, 3.4.x < 3.4.12, 4.0.x < 4.0.9 fixed 3.3.13, 3.4.12, 4.0.9

## How to check

Check the GitLab version (gitlab-rake gitlab:env:info) and how it was installed. Official Omnibus packages and GitLab images on the fixed release line carry the patched Ruby. For source installs or custom or third-party images (including alpinelinux/gitlab tags pulled before 27 Oct), run 'ruby -v' inside the GitLab runtime: below 3.3.13, 3.4.12 or 4.0.9 means it is vulnerable. Look for repeated GitLab worker crashes or 502s around CI config submissions, and newly registered accounts pushing unusual .gitlab-ci.yml content. No network indicators were published (unknown).

## Fix

Upgrade GitLab to a fixed release (official packages are fixed from 12 Oct). If you run GitLab on your own Ruby, also upgrade Ruby to 3.3.13, 3.4.12, 4.0.9 or later. On Alpine, run apk upgrade, or pull alpinelinux/gitlab:19.3.6 again (rebuilt 27 Oct). Until patched, close open sign-ups. If you were exposed while unpatched with open registration, treat the instance as possibly compromised: rotate CI/CD variables, runner tokens, webhook, integration and mirror credentials, personal access tokens and 2FA secrets, and reset passwords. Also apply Ruby updates to other Ruby apps that compile untrusted regexes.

## Timeline

- 2026-10-28T23:59:17+00:00 analyst

## Documents

- [describes] GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 https://news.ycombinator.com/item?id=50282544
- [describes] GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_