GitLab is back: what you need to do

gitlab.alpinelinux.org is open again. It runs on a new server that we built from scratch after the attempted exploitation of CVE-2026-97229. It runs GitLab 19.3.7 with Ruby 3.3.13, which has the fix.

Your account, projects, issues and merge requests are all there. But we replaced GitLab’s secret keys, so passwords, 2FA, tokens and some stored secrets no longer work. This post lists what you need to set up again.

If you have questions, ask us in #alpine-infra on the OFTC IRC network. For anything you don’t want to ask in public, email infra@alpinelinux.org.

Everyone

Set a new password

All passwords have been reset. Use “Forgot your password?” on the sign-in page to set a new one.

If you sign in with GitHub, GitLab.com or postmarketOS, that still works.

If you used your old gitlab.alpinelinux.org password anywhere else, change it there too. We have seen automated login attempts against our GitLab using passwords leaked from other sites.

Set up two-factor authentication again

2FA has been reset for all accounts, both authenticator apps and security keys. Old recovery codes no longer work. After you sign in, set up 2FA again under Preferences > Account, and delete the old gitlab.alpinelinux.org entry from your authenticator app.

Accept the new SSH host keys

The server has new SSH host keys, so the first time you git pull or git push over SSH, you get a warning that the host key has changed. Remove the old key:

ssh-keygen -R gitlab.alpinelinux.org

When you connect again, check that the fingerprint matches one of these:

SHA256:0IBWmctjXkWm8rTVLQK+Op0b7XGFRI5pKZInbLNfgKc (ED25519)
SHA256:9B7JoqH1FMOa6edbjzAhzYSC29ft2ckxhKDUsp8S9ho (ECDSA)
SHA256:fD/PxYm/rh/SFQnpID4Y0jd4cDZjK5TAR6l9E097Q/w (RSA)

Or add the keys to ~/.ssh/known_hosts yourself:

gitlab.alpinelinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK4/XEEdwtUWR6lvyC9XfefskSmWuvxeUK6byjxSAzsa
gitlab.alpinelinux.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCc+pcyakPHOK/OtW4eM8HKaGABoWKjOCxhuRLi8uLmwD/+QIXZS/6Z9ndhHQnSX8mBvWVbo1/VhHvoQy2YsyOo=
gitlab.alpinelinux.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDqyDpjc+wowWA5LY+t24ZPeYjSC93eSZ2hHwS+fqfG71hT5xs6cmK9wd/zYzipzwQ6hE26JAZoYL+UQTcS3I7VCOv/Nq7ZXxbX4QsuWICV/+6ZaT/MIi+o54fh1ERNjQu/GhpS0kRap6KG+AeMMloHicfRVAPgxkjwdOdnqFDPXyabLjGLKeNgrJgLOvC+qJKJCJTeqNvGUX0QclKfgW5HZXfkShFt9Y/2xAfwvG4ajvesLSVM7+Xz2ndMxL/feEIXRGNx2LhCcWFlxC5z2+SwTRo67/540to6cSBbEJsMFacxsL47dXOYC7A3Q8tbr4Euj2Ers4nTEaxZ6XBSVvn7S+aEGtD4f63psfwvaZGWKu/bFXrNMdBGj9R3L/GjX9kUml481w/NvNnP6sFyG3X2DrvIGPPs7nNKPiXJEShpVLXfVo5lfNGiA/N/B+KzywmOgJycaMa5Ks536sBfj7wdhoZTa91KomSXnHb5IHwT2Esj3cd3qTH72R1R8yyQihE=

Your SSH keys and GPG keys were kept, so you don’t need to upload them again.

Create new access tokens

Previously created personal access tokens no longer work. If you use one for git over HTTPS, glab or scripts, create a new one under Preferences > Access tokens.

Update feed URLs and email addresses

The tokens in RSS and calendar feed URLs, and the private email addresses used to create issues or reply by email, have been reset. Copy the new URLs and addresses from GitLab.

New accounts

New accounts registered with an email address and password must now be approved by an admin before you can use them. To get approved faster, tell us in #alpine-infra on the OFTC IRC network as soon as you have signed up. Ask there too if your account was rejected.

Project maintainers

Enter CI/CD variable values again

The values of all CI/CD variables are gone. The variables themselves are still there, with their names and settings, but their values are empty. Under Settings > CI/CD > Variables, enter each value again. Pipeline schedule variables need the same.

Assume the old values may have been exposed. Where you can, use new credentials rather than the old ones.

Check integrations, webhooks and mirrors

Integration settings (under Settings > Integrations) no longer work. Enter their tokens and passwords again.

Webhooks and push mirrors were moved to the new server and should still work. But their secret tokens and passwords may have been exposed, so replace them with new ones. If you own an OAuth application on our GitLab, renew its secret too.

We're sorry for the disruption, and thank you for your patience while GitLab was closed. Thanks also to everyone who helped investigate the incident and rebuild the server.