The Alpine Linux project says an actor attempted to exploit CVE-2026-97229 against its GitLab instance. The team says it found no modified packages, while noting that it cannot definitively rule out code execution. That distinction matters: an attempt does not establish a successful compromise.
The vulnerability is rated critical. Teams running GitLab should check the vendor’s notice for affected versions and apply updates appropriate to their deployment.
What Alpine Linux observed
In its incident report, Alpine says it detected an attempt targeting its GitLab instance. The project reviewed its repositories and found no modified packages. It does not present that finding as absolute proof that no command ran: the team says it cannot conclusively rule out that possibility.
SecurityWeek and The Hacker News report the same limits in the public account. It is therefore accurate to describe an attempted exploit, not to claim the attacker published malicious code in Alpine packages.
A critical GitLab vulnerability
CVE-2026-97229 affects GitLab. Administrators should use GitLab’s security notice and release notes to identify affected versions, fixes, and any available mitigations.
Internet-facing instances and self-managed installations should be inventoried promptly. For installations using official packages and images, follow GitLab’s fixed releases. If you supply your own Ruby, from source or in a custom image, updating GitLab alone may not be enough: Alpine says the fix is in the Ruby bundled with GitLab packages and recommends Ruby 3.3.13, 3.4.12, or 4.0.9, or later, depending on the branch. If an immediate patch is not possible, follow official mitigations and restrict relevant network access.
Review repositories and pipelines
For an instance that may have been targeted, review authentication and administrative logs, recently created accounts, keys and tokens, repository changes, and pipeline changes. Compare artifacts with known revisions and check permissions granted to CI/CD integrations.
This review cannot by itself prove that no incident occurred. It can help identify unexpected changes and determine whether a wider response is needed. Preserve relevant logs before cleanup actions.
A software supply-chain risk
A source control platform can provide access to repositories, build workflows, and sometimes automation secrets. Teams should limit permissions to what is needed, protect privileged accounts, and review tokens stored in pipelines.
Those steps are useful even without a confirmed compromise. They can reduce potential impact if an instance or account is targeted successfully.
Soclyde’s connection
Soclyde helps teams organise access they manage in an encrypted vault on their devices. It does not patch a GitLab instance or replace CI/CD token management. Read our guide to local versus cloud storage for ways to structure team access.
What to remember
Alpine Linux reports an attempted CVE-2026-97229 exploit and says it found no modified packages, while retaining a caveat about possible code execution. Apply GitLab fixes, review activity, and do not describe the attempt as a confirmed compromise.
