GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

On October 20 and 21, an attacker attempted to exploit a critical GitLab vulnerability (CVE-2026-97229) on their instance, just a week after the fix was released. The attack seemed close to succeeding, leading to the assumption that the instance might have been compromised. However, no proof of success was found, so the instance was treated as compromised and rebuilt from scratch.

The vulnerability, CVE-2026-97229, is a critical (CVSS 10.0) issue in GitLab's evaluation of regular expressions in CI configuration. It originates from the Onigmo regular expression engine within Ruby. GitLab released fixes on October 12, but the patch was only included in specific Ruby versions - Ruby 3.3.13, 3.4.12, and 4.0.9.

The attack took place as a newly registered account sent crafted CI configurations to the GitLab instance, which was still running version 19.3.4 without the October 12 fix. This caused the GitLab worker processes to crash eight times. In four of those crashes, the attacker managed to progress partway through the exploit before failing at the next step.

The attacker also downloaded GitLab's container image, indicating they were fine-tuning the exploit for the specific build.

Despite upgrading to GitLab version 19.3.6 on October 22, the vulnerability remained unfixed. This is because the fix is not in GitLab's code but a patch to Ruby, which GitLab applies only in its official packages. Since the image used standard Ruby, it did not receive the patch. Users who run GitLab with their own Ruby (from source or in their own container image) must update to Ruby 3.3.13, 3.4.12, or 4.0.9 or later for the fix to apply.

If the attack had succeeded, it could have potentially exposed sensitive information and led to unauthorized code execution. However, due to the inability to rule out the possibility of successful code execution and the missing evidence, the decision was made to rebuild the GitLab instance from scratch. This not only eliminates any possible foothold that might have been left behind from a successful exploit but also ensures the security of the system for the future.