A GitLab flaw rated a perfect 10.0 forced Alpine Linux to rebuild its server from scratch and reset every password, SOCRadar reported in an update on Oct. 30, 2026. The flaw, tracked as CVE-2026-97229, sits in the continuous integration and delivery pipeline and lets an unauthenticated attacker run code through a regular expression weakness.
The warning signs stacked up fast. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Oct. 29, confirming active exploitation, and set a federal patch deadline of Nov. 1. Rapid7 then reproduced the exploit, showing the attack works as described rather than in theory only.
Patching the version number is not the same as patching the software.
Alpine Linux learned that the hard way. Upgrading the GitLab application alone did not fix the flaw, because the vulnerable code also lived in a bundled Ruby component shipped with it. The distribution rebuilt its server and reset all passwords instead of trusting a partial fix. Teams running self-managed GitLab through managed infrastructure and integration support face the same trap: the headline version can look current while a bundled component stays exposed.
If your team runs self-managed GitLab, inventory what ships inside the install, patch the bundled components, rotate credentials after any exposure window, and treat a perfect-score flaw in your pipeline as a rebuild decision, not a routine update.