In gymnastics, a perfect 10 gets you a medal. In vulnerability scoring, it gets you an urgent entry in CISA's catalog. On October 29 the agency added a CVSS 10.0 GitLab flaw to its Known Exploited Vulnerabilities list, alongside a Cisco firewall bug attackers are already using.
A Malicious Regex Walks Into a Pipeline
The GitLab bug, CVE-2026-97229, is an integer overflow in GitLab Community and Enterprise Editions. According to The Hacker News, insufficient regex validation lets an unauthenticated attacker run arbitrary code on a GitLab server by slipping a specially crafted regular expression into a CI/CD configuration. Federal agencies were advised to patch by November 1.
The real-world near miss comes from Alpine Linux. Its maintainers disclosed that an unknown attacker tried the exploit against Alpine's unpatched GitLab instance on October 20 and 21, crashing GitLab worker processes eight times and downloading the project's GitLab container image. Later attempts on October 25 and 26 were blocked. Alpine said the attack came close to working and found no evidence it succeeded, but rebuilt the server from scratch anyway and confirmed its packages and October 21 releases weren't tampered with. The Cisco flaw, CVE-2026-76418 (CVSS 8.6), lets a remote attacker force Secure Firewall ASA and FTD devices to reload, knocking them offline.
Your Build Server Holds the Keys
A GitLab server is one of the most valuable machines a company owns. It holds your source code, your CI secrets, your deploy keys, and the pipeline that pushes changes to production. Whoever owns it owns everything downstream, which is why attackers keep circling build infrastructure.
Alpine's response is the part worth stealing. "No evidence of compromise" would have been an easy place to stop. The maintainers treated the server as compromised anyway, rebuilt it, and verified their releases. When thousands of downstream projects trust your packages, that's how you handle a close call, and it's a good standard for any team running self-hosted dev tools.
Patch GitLab today, then take an honest look at what your CI secrets could unlock in the wrong hands.
If this has you wondering how exposed your own pipeline is, our free supply-chain security checklist for developers covers build servers, secrets, and the other places attackers like to start.
Source: The Hacker News