GitLab CVE-2026-97229 selected (24.3/25) over Brotli, Drupal Commerce and Cisco. Added vendor/KEV/Alpine/Ruby/Rapid7 evidence; established custom-Ruby false-remediation risk; preserved successful-compromise, exploit-precondition, prevalence and attribution negative space.
EVIDENCE
الأدلة وما تثبته
5 سجل
VEI-E-0004
GitLab states CVE-2026-97229 can under certain conditions allow an unauthenticated user to execute arbitrary code via crafted CI/CD regex; affected self-managed 19.2<19.2.8, 19.3<19.3.5, 19.4<19.4.2; GitLab.com/Dedicated patched; detections released.
UNKNOWN
Supports
Affected/fixed versions, vendor-described RCE consequence and detections.
Does not prove
Victim count, campaign scale, attacker identity or identical exploit prerequisites across all configurations.
CISA added CVE-2026-97229 to KEV on 2026-10-29, establishing authoritative known-exploitation status and urgent remediation/forensic relevance.
UNKNOWN
Supports
Known exploitation status.
Does not prove
Raw incidents, successful victim count, actor identity, campaign scale or ransomware use.
Confidence
غير مسجل
CONTRADICTIONS
التناقضات والقيود
لا توجد تناقضات مسجلة لهذه الجولة.
UNCERTAINTY
الفجوات غير المحسومة
{"Notes":"KEV/attempted exploitation ≠ public success denominator.","Gap ID":"CY-GAP-VEI-B7C4E291-01","Impact":"Blocks prevalence, success-rate and campaign-scale claims.","Status":"OPEN","Gap Type":"PUBLIC_SUCCESS_AND_SCALE","Priority":"HIGH","Domain ID":"CY-DOM-003","Topic IDs":"CY-TOP-VEI-B7C4E291","Description":"No reliable public count of successfully exploited GitLab victims, attack volume or current compromised population for CVE-2026-97229.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-VEI-20261101T100800Z-B7C4E291","Required Evidence / Resolution":"CISA raw evidence, multi-victim IR/provider telemetry or authoritative victim reporting."}
{"Notes":"Preserve vendor 'under certain conditions' wording.","Gap ID":"CY-GAP-VEI-B7C4E291-02","Impact":"Blocks universal precondition-free unauthenticated-RCE claims.","Status":"OPEN","Gap Type":"AUTH_PRECONDITION_IDENTITY","Priority":"HIGH","Domain ID":"CY-DOM-003","Topic IDs":"CY-TOP-VEI-B7C4E291","Description":"Exact original private exploit route and whether it removes the content-write prerequisite in Rapid7's public chain remain undisclosed.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-VEI-20261101T100800Z-B7C4E291","Required Evidence / Resolution":"Original HackerOne/vendor technical disclosure or independent no-write-precondition reproduction."}
FOLLOW-UP
المتابعات غير المحسومة
4 مفتوحة
PUBLIC_SUCCESS_AND_SCALE
No reliable public count of successfully exploited GitLab victims, attack volume or current compromised population for CVE-2026-97229.
OPEN
Priority: HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
AUTH_PRECONDITION_IDENTITY
Exact original private exploit route and whether it removes the content-write prerequisite in Rapid7's public chain remain undisclosed.
OPEN
Priority: HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
RUNTIME_PATCH_PROVENANCE
No reliable denominator exists for custom GitLab deployments upgraded at the app layer but still using vulnerable Ruby/Onigmo.
OPEN
Priority: MEDIUM · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
ATTRIBUTION_CAMPAIGN
Actor identity, infrastructure, victim clustering, campaign breadth and ransomware relationship remain unproven.
OPEN
Priority: MEDIUM · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
AUDIT TIMELINE
السجل الزمني الكامل
0 حدث
لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.
Alpine documents Oct-20/21 crafted-CI exploitation attempts: eight worker crashes, four partial exploit progressions and attacker download of the GitLab image. No evidence of attacker code execution was found, but Alpine could not rule it out due missing telemetry. Its GitLab 19.3.6 upgrade left the custom image vulnerable because standard Ruby lacked GitLab's bundled patch.
UNKNOWN
Supports
Real targeting, exploit tuning behavior, uncertainty boundary and custom-runtime false-remediation failure mode.
Does not prove
Successful code execution, data theft, package/release tampering, signing-key exposure or broad campaign scale.
Rapid7 independently reproduced arbitrary command execution on unpatched official GitLab 19.4.1 CE and confirmed patched 19.4.2 blocked its disclosed chain. The public route requires attacker-controlled malicious CI content before an unauthenticated CI-lint trigger; Rapid7 provides worker-crash/502, CI-lint, regexp/path and memory/process detection guidance.
UNKNOWN
Supports
Independent RCE exploitability, disclosed route prerequisites and defensive detections.
Does not prove
In-the-wild successful compromise, victim scale, actor identity or equivalence to the undisclosed original route.
Confidence
غير مسجل
Context
CVE-2026-97229
Rapid7فتح المصدرCY-T2 / Independent Security Research
{"Notes":"Alpine proves failure mode, not prevalence.","Gap ID":"CY-GAP-VEI-B7C4E291-03","Impact":"Blocks quantifying false-remediation exposure.","Status":"OPEN","Gap Type":"RUNTIME_PATCH_PROVENANCE","Priority":"MEDIUM","Domain ID":"CY-DOM-003","Topic IDs":"CY-TOP-VEI-B7C4E291,CY-TOP-007","Description":"No reliable denominator exists for custom GitLab deployments upgraded at the app layer but still using vulnerable Ruby/Onigmo.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-VEI-20261101T100800Z-B7C4E291","Required Evidence / Resolution":"Version-aware GitLab+Ruby telemetry or large-sample authenticated inventory."}
{"Notes":"Do not attribute by exploit/TTP similarity alone.","Gap ID":"CY-GAP-VEI-B7C4E291-04","Impact":"Blocks actor/campaign attribution.","Status":"OPEN","Gap Type":"ATTRIBUTION_CAMPAIGN","Priority":"MEDIUM","Domain ID":"CY-DOM-003","Topic IDs":"CY-TOP-VEI-B7C4E291","Description":"Actor identity, infrastructure, victim clustering, campaign breadth and ransomware relationship remain unproven.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-VEI-20261101T100800Z-B7C4E291","Required Evidence / Resolution":"Independent actor-linked infrastructure, repeated incident artifacts or authoritative attribution."}
NEW — GitLab critical RCE + Oct-29 KEV + Alpine real exploitation attempts + independent Rapid7 RCE reproduction verified. Alpine demonstrates version-only false remediation for custom Ruby packaging. Successful Alpine compromise, universal no-write exploitability, victim scale and attribution remain gated.