Our takeAlpine Linux's own GitLab instance was probed with the CVE-2026-97229 RCE in GitLab CE/EE a week after the patch dropped; they saw no compromise, rebuilt the server, and reset passwords anyway. Patch your self-hosted GitLab immediately if you haven't.Security Resilience desk
Sources (2)
- hackernews · hackernews
- bleeping · bleeping
What this means for you — Security leader:Patch GitLab instances to at least 17.4.6, 17.5.4, or 17.6.2 immediately. Rebuild affected servers and force password resets if you saw similar exploit attempts.
What this means for you — Lean IT orgs:If you self-host GitLab, update it right away to the latest version and consider resetting passwords. Most teams using GitLab.com or managed hosting can ignore this.
What this means for you — MSP:Audit client GitLab self-hosted instances for the CVE-2026-97229 patch level; rebuild and reset credentials on any that were exposed around 20-21 October.
What this means for you — Researcher:Alpine Linux detected and blocked an attempted RCE via CVE-2026-97229 on their own GitLab server shortly after the patch dropped; no compromise confirmed.