GitLab is back: what you need to do

Key points

gitlab.alpinelinux.org is back online on a new server, rebuilt from scratch after an attempted exploitation of CVE-2026-97229. Accounts, projects, issues and merge requests were preserved. Because GitLab's secret keys were replaced, passwords, 2FA, tokens and some stored secrets must be set up again.

Versions

• The new instance runs GitLab 19.3.7 with Ruby 3.3.13, which includes the fix for CVE-2026-97229.

What every user must do

• Passwords: all were reset. Use "Forgot your password?" on the sign-in page to choose a new one. Signing in through GitHub, GitLab.com or postmarketOS still works.
• If the old gitlab.alpinelinux.org password was reused on other sites, change it there as well. The project has seen automated login attempts on its GitLab using passwords leaked elsewhere.
• 2FA: reset for every account, covering both authenticator apps and security keys. Old recovery codes are invalid. Re-enroll under Preferences > Account and remove the old gitlab.alpinelinux.org entry from the authenticator app.
• Personal access tokens: all old tokens stopped working. Anyone using one for git over HTTPS, glab or scripts must create a new one under Preferences > Access tokens.
• Feed tokens in RSS and calendar URLs have been reset. So have the private email addresses used for creating issues or replying by email. Copy the new ones from GitLab.
• Uploaded SSH keys and GPG keys were kept and do not need to be added again.

New SSH host keys

• The server has new host keys, so the first git pull or git push over SSH will warn that the host key changed.
• Remove the old entry, then reconnect:

ssh-keygen -R gitlab.alpinelinux.org

• On reconnecting, the fingerprint should match one of these:
• SHA256:0IBWmctjXkWm8rTVLQK+Op0b7XGFRI5pKZInbLNfgKc (ED25519)
• SHA256:9B7JoqH1FMOa6edbjzAhzYSC29ft2ckxhKDUsp8S9ho (ECDSA)
• SHA256:fD/PxYm/rh/SFQnpID4Y0jd4cDZjK5TAR6l9E097Q/w (RSA)
• As an alternative, the original post lists the full public keys so they can be added to ~/.ssh/known_hosts by hand.

New accounts

• An admin now has to approve accounts registered with an email address and password before they can be used.
• To speed up approval, or if an account was rejected, ask in #alpine-infra on the OFTC IRC network after signing up.

Project maintainers

• CI/CD variables still exist with their names and settings, but every value is now empty. Re-enter each value under Settings > CI/CD > Variables. Pipeline schedule variables also need their values re-entered.
• Treat the old CI/CD values as possibly exposed and switch to new credentials where possible.
• Integrations under Settings > Integrations stopped working. Their tokens and passwords must be entered again.
• Webhooks and push mirrors were carried over and should still function. Their secret tokens and passwords may have been exposed, so they should be replaced.
• Owners of OAuth applications on the instance should renew the application secret.

Contact

• Questions go to #alpine-infra on OFTC IRC. Private matters go to [email protected].

Summary by DistroNews, based on the original post.