GitLab patches critical pipeline impersonation and multiple self-managed flaws

GitLab issued several security patch releases for Community Edition and Enterprise Edition to fix vulnerabilities affecting self-managed deployments, including two critical pipeline impersonation flaws that could let an attacker run CI/CD pipeline jobs as another user. The issues were tracked as CVE-2024-5655 and CVE-2024-6385, with the latter included alongside fixes for group URL modification, deploy token creation, package registry manifest confusion, group member banning, and GitLab Pages subdomain takeover. GitLab said GitLab.com and GitLab Dedicated were already running patched versions and reported no evidence of abuse of CVE-2024-5655 on GitLab-managed platforms.

Subsequent patch releases addressed additional high- and medium-severity weaknesses, including stored cross-site scripting in Asciidoctor rendering (CVE-2025-0314), CI/CD variable exfiltration through CI lint (CVE-2024-11931), denial of service via cyclic epic references (CVE-2024-6324), access token exposure in logs, unauthorized issue status changes in public projects, and an Instance SAML configuration flaw that could expose internal projects or groups. GitLab also changed importer behavior after earlier importer-related problems, adding post-import mapping and user acceptance controls, and warned self-managed administrators using Direct Transfer, GitHub, Bitbucket Server, or Gitea importers to disable those features until upgraded.