CVE-2026-97229: Critical GitLab RCE (CVSS 10.0) Exploited Against Alpine Linux — Detection and Remediation Guide

---
title: GitLab Rails Process Spawning Shell or System Binary
description: Detects the GitLab web application process (puma/ruby/sidekiq) spawning a shell or system utility, consistent with post-exploitation activity following RCE such as CVE-2026-97229. GitLab application processes do not legitimately spawn interactive shells.
references:
  - https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/29
status: experimental
id: 3f8a1c52-9b4d-4e67-a812-5e6c9d0f1a2b
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/puma'
      - '/ruby'
      - '/sidekiq'
      - '/gitaly'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - GitLab backup or maintenance rake tasks executed by administrators (rare via puma; typically invoked from shell)
  - Health-check scripts misconfigured to run under the application user
level: high
---
title: GitLab CI Runner Executing Shell Outside Expected Job Context
description: Detects suspicious child processes spawned by gitlab-runner that indicate command-and-control or payload staging, such as base64-decoded payloads, reverse shells, or downloads to temporary directories. Relevant to post-exploitation after CI configuration-based RCE (CVE-2026-97229).
references:
  - https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/29
status: experimental
id: 8c2d4e61-7a1b-4f39-b506-2d8e5a3c7b94
tags:
  - attack.execution
  - attack.t1059.004
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/gitlab-runner'
      - '/gitlab-runner-helper'
  selection_suspicious:
    CommandLine|contains:
      - 'base64 -d'
      - 'base64 --decode'
      - '/dev/tcp/'
      - 'curl -s '
      - 'wget -q '
      - 'chmod +x /tmp/'
      - 'chmod +x /dev/shm/'
      - 'nc -e'
      - 'ncat -e'
  condition: selection_parent and selection_suspicious
falsepositives:
  - Legitimate CI jobs that download and execute build tooling (tune allowlists per pipeline; alert on non-allowlisted projects)
level: medium
---
title: New External User or Project Created Followed by Rapid Pipeline Activity
description: Detects behavioral precursor to CI configuration attacks: a newly created account or project immediately triggering pipeline execution, a pattern consistent with abuse of open-registration GitLab instances for exploit delivery as seen against Alpine Linux.
references:
  - https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/29
status: experimental
id: 5b1e7f38-2c6a-4d84-9e17-8f3a6b2c4d51
tags:
  - attack.initial_access
  - attack.t1190
  - attack.resource_development
logsource:
  product: linux
  service: gitlab
detection:
  selection:
    - 'event': 'project_created'
    - 'event': 'user_created'
    - 'event': 'pipeline_created'
  condition: selection
falsepositives:
  - High-volume legitimate community activity on open instances; this rule is intended for correlation (user_created followed by pipeline_created from the same user within minutes), not standalone alerting
level: low

// Hunt 1: GitLab application processes spawning shells or download tools (post-RCE behavior)
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ ("puma", "ruby", "sidekiq", "gitaly", "gitlab-runner")
    or SyslogMessage has_any ("puma", "sidekiq", "gitlab-runner")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "base64 -d", "/dev/tcp/", "nc -e", "curl -s", "wget -q")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 2: Pipeline creation events from recently created external users (exploit staging)
let GitlabEvents = Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("user_created", "project_created", "pipeline_created", "ci_cd")
| extend Event = extract(@"(user_created|project_created|pipeline_created)", 1, SyslogMessage)
| extend Actor = extract(@"\"?(?:author_name|username|user)\"?[:=]\s*\"?([\w.@-]+)", 1, SyslogMessage)
| where isnotempty(Event) and isnotempty(Actor);
let NewUsers = GitlabEvents | where Event == "user_created" | summarize FirstSeen = min(TimeGenerated) by Actor;
GitlabEvents
| where Event == "pipeline_created"
| join kind=inner NewUsers on Actor
| extend MinutesAfterSignup = datetime_diff("minute", TimeGenerated, FirstSeen)
| where MinutesAfterSignup <= 60
| project TimeGenerated, Actor, Event, MinutesAfterSignup, Computer, SyslogMessage
| order by MinutesAfterSignup asc;

// Hunt 3: Outbound connections from GitLab server processes to rare external destinations (C2 / exfil)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceProduct has "GitLab" or SourceHostName has "gitlab"
| where DestinationIsIpv4 and not(ipv4_is_private(DestinationIP))
| summarize ConnectionCount = count(), DistinctPorts = dcount(DestinationPort) by SourceHostName, DestinationIP, DestinationPort
| where ConnectionCount < 5 and DestinationPort !in (443, 80, 22, 53)
| order by ConnectionCount asc;

-- Hunt: GitLab RCE post-exploitation artifacts (CVE-2026-97229 scenario)
-- Part 1: Suspicious child processes of GitLab application services
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(base64 -d|/dev/tcp/|nc -e|ncat -e|curl -s|wget -q|chmod \+x /tmp|chmod \+x /dev/shm)'
   OR (Name =~ '^(sh|bash|dash|python3?|perl|curl|wget|nc|ncat)$'
       AND Username =~ 'git')

-- Part 2: Recently created executable files in temp/writable directories on the GitLab host
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/tmp/**', '/dev/shm/**', '/var/tmp/**'], accessor='file')
WHERE Mtime > (now() - 604800)
  AND NOT IsDir
  AND FullPath !~ '(bundle|node_modules|cache|\.gem|ruby|prometheus|gitaly)'
ORDER BY Mtime DESC

-- Part 3: Established outbound connections owned by the git user (C2 triage)
SELECT Pid, Name, Laddr, Raddr, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND Name =~ '(ruby|puma|sidekiq|sh|bash|python|nc)'
  AND Raddr.IP !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

#!/bin/bash
# CVE-2026-97229 GitLab verification and patch script (omnibus installations)
# Run as root. Always snapshot/backup before upgrading production GitLab.

set -euo pipefail

echo "=== [1] Current GitLab version ==="
if command -v gitlab-rake >/dev/null 2>&1; then
    gitlab-rake gitlab:env:info 2>/dev/null | head -20 || true
fi
dpkg -l gitlab-ee gitlab-ce 2>/dev/null | grep ^ii || \
rpm -qa | grep -i gitlab || echo "[!] GitLab package not found — is this an omnibus host?"

echo ""
echo "=== [2] Backing up GitLab configuration ==="
BACKUP_DIR="/var/opt/gitlab/backups/pre-cve-2026-97229-$(date +%Y%m%d%H%M)"
mkdir -p "$BACKUP_DIR"
cp -a /etc/gitlab/gitlab.rb "$BACKUP_DIR/" 2>/dev/null || true
cp -a /etc/gitlab/gitlab-secrets.json "$BACKUP_DIR/" 2>/dev/null || true
echo "Config backup staged at $BACKUP_DIR"

echo ""
echo "=== [3] Updating GitLab package ==="
# IMPORTANT: Pin to the fixed version per the official GitLab release notes for CVE-2026-97229.
# Check https://about.gitlab.com/releases/categories/releases/ for the exact patched version.
if command -v apt-get >/dev/null 2>&1; then
    apt-get update
    apt-get install -y gitlab-ce    # or: gitlab-ee  (use the edition you run; pin version if required)
elif command -v dnf >/dev/null 2>&1; then
    dnf install -y gitlab-ce
elif command -v yum >/dev/null 2>&1; then
    yum install -y gitlab-ce
fi

echo ""
echo "=== [4] Reconfigure and verify services ==="
gitlab-ctl reconfigure
gitlab-ctl status

echo ""
echo "=== [5] Post-patch compromise checks ==="
echo "--- Processes running as 'git' user (review for shells/downloaders) ---"
ps -u git -o pid,ppid,comm,args | grep -Ev '(puma|sidekiq|gitaly|gitlab-|postgres|redis|exporter|ruby /opt/gitlab)' || echo "None unexpected."

echo ""
echo "--- Recently modified files in temp dirs ---"
find /tmp /var/tmp /dev/shm -type f -mtime -7 -ls 2>/dev/null | head -30 || echo "None found."

echo ""
echo "--- Recently created GitLab users (last 14 days) ---"
gitlab-rails runner 'puts User.where("created_at > ?", 14.days.ago).pluck(:username, :created_at, :sign_in_count)' 2>/dev/null || \
echo "[!] Run manually: gitlab-rails runner 'puts User.where(\"created_at > ?\", 14.days.ago).pluck(:username, :created_at)'"

echo ""
echo "=== Done. Verify patched version against the GitLab advisory for CVE-2026-97229. ==="
gitlab-rake gitlab:env:info 2>/dev/null | head -5