Loading story…
GitLab released security updates addressing a high-severity runner hijacking vulnerability (CVE-2025-11702) and multiple denial-of-service (DoS) vulnerabilities affecting both GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerabilities impact versions prior to 18.5.1, 18.4.3, and 18.3.5, and could allow attackers to compromise CI/CD runners or disrupt GitLab services. Administrators are urged to apply the latest patches to mitigate these risks and ensure the security of their GitLab environments.
The runner hijacking flaw could enable unauthorized access or control over GitLab runners, posing a significant threat to organizations relying on automated pipelines. The coordinated disclosure and patch release highlight the importance of timely updates, as exploitation of these vulnerabilities could lead to service outages or further compromise within affected environments.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
GitLab issued security updates addressing the high-severity runner hijacking vulnerability CVE-2025-11702 along with multiple denial-of-service vulnerabilities. The fixes were publicly reflected in security reporting and an official advisory on October 22, 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released security updates `17.3.2`, `17.2.5`, and `17.1.7` for self-managed Community Edition and Enterprise Edition instances, fixing 18 vulnerabilities including a critical issue tracked as `CVE-2024-6678` with a CVSS score of 9.9. The flaw could let an attacker trigger a CI/CD pipeline as an arbitrary user and perform a stop action under certain conditions. GitLab said GitLab.com is already running the patched version and GitLab Dedicated customers do not need to take action. The release also fixes several high-severity bugs, including command injection into a connected Cube server via YAML configuration (`CVE-2024-8640`), server-side request forgery through Maven Dependency Proxy requests to internal resources (`CVE-2024-8635`), and a denial-of-service condition caused by a crafted POST request or large `glm_source` parameter (`CVE-2024-8124`). Additional medium-severity patches address token and session abuse, permission bypasses, information disclosure, and open redirects that could contribute to account takeover through broken OAuth flows, and GitLab urged all self-managed administrators to upgrade immediately.
Jul 24, 2026
GitLab released security updates for Community Edition and Enterprise Edition, shipping versions **19.2.1**, **19.1.3**, and **19.0.5** to fix 13 vulnerabilities and urging self-managed customers to upgrade immediately. GitLab said **GitLab.com** is already patched and **GitLab Dedicated** customers do not need to take action. The most severe issue, **`CVE-2026-6267`**, affects internal request handling in GitLab Workhorse and could let an authenticated user with the **Developer** role access unauthorized information because of insufficient access controls; affected versions span **10.1.0 before 19.0.5**, **19.1 before 19.1.3**, and **19.2 before 19.2.1**.
Aug 3, 2026
GitLab released security updates `17.3.2`, `17.2.5`, and `17.1.7` for self-managed Community Edition and Enterprise Edition to fix multiple vulnerabilities, including the critical `CVE-2024-6678`. GitLab said the flaw can let an attacker trigger a pipeline as an arbitrary user under certain circumstances and assigned it a `CVSS 9.9`, urging customers to upgrade immediately. GitLab.com had already been patched, and GitLab Dedicated customers did not need to take action. The patch bundle also addressed three high-severity issues and numerous medium- and low-severity flaws affecting pipelines, Product Analytics, Dependency Proxy, OAuth flows, CI/CD variables, repository mirroring, and access controls. A separate CVE entry for `CVE-2024-8640` was listed without public details, while GitLab also noted one issue involving arbitrary unclaimed provider identities had not yet received a CVE at the time of publication.
Jul 24, 2026