Loading story…
GitLab released patched versions 17.6.1, 17.5.3, and 17.4.5 for Community Edition and Enterprise Edition to fix multiple security issues, led by CVE-2024-8114, a high-severity privilege-escalation vulnerability involving LFS tokens. GitLab said the flaw affects a broad range of GitLab CE/EE versions and can be exploited by an attacker who has access to a victim’s Personal Access Token. The company said GitLab.com was already running the patched version, while self-managed customers were urged to upgrade immediately.
The release also addressed several medium-severity issues, including denial-of-service conditions, unintended access to usage data through scoped tokens, and an authentication weakness in a streaming endpoint. Public references in the vulnerability records include CVE-2024-8114, CVE-2024-8177, and CVE-2024-8237, tying the fixes to GitLab’s broader November security update for both CE and EE deployments.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
On November 26, 2024, GitLab released versions 17.6.1, 17.5.3, and 17.4.5 for Community Edition and Enterprise Edition. The release addressed several security issues, including the high-severity privilege-escalation flaw CVE-2024-8114, and GitLab urged self-managed users to upgrade immediately.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcedocs.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released security updates `18.8.4`, `18.7.4`, and `18.6.6` for Community Edition and Enterprise Edition to fix multiple vulnerabilities affecting self-managed deployments, and urged customers to upgrade immediately. The most severe issue, **CVE-2025-7659** with CVSS `8.0`, is an incomplete validation flaw in the Web IDE that could allow an unauthenticated attacker to steal tokens and gain access to private repositories. GitLab.com had already been patched, and GitLab Dedicated customers were not required to take action. The release also addressed additional vulnerabilities tracked as **CVE-2025-8099**, **CVE-2026-0958**, **CVE-2026-0595**, and **CVE-2025-14560**, covering several denial-of-service conditions, cross-site scripting, HTML injection, server-side request forgery, and authorization bypasses across GitLab CE/EE and EE. GitLab said the patch release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid downtime by following zero-downtime upgrade procedures.
Jul 24, 2026
GitLab released patched Community Edition and Enterprise Edition versions `17.2.2`, `17.1.4`, and `17.0.6` to fix multiple medium-severity security vulnerabilities affecting self-managed deployments. GitLab.com was already running the remediated version, and the company urged administrators of affected self-managed instances to upgrade immediately. The update addressed a broad range of issues, including privilege escalation, cross-project access, several denial-of-service conditions, cross-site scripting, sensitive data exposure in logs, approval bypass, and audit log credential retention. CVEs tied to the release included `CVE-2024-4210`, `CVE-2024-5423`, and `CVE-2024-6356`, alongside other assigned identifiers such as `CVE-2024-3035`, `CVE-2024-2800`, `CVE-2024-6329`, `CVE-2024-4207`, `CVE-2024-3958`, `CVE-2024-4784`, `CVE-2024-3114`, and `CVE-2024-7586`, with two additional issues still awaiting CVE assignment at publication time.
Jul 24, 2026
GitLab released security updates `17.3.2`, `17.2.5`, and `17.1.7` for self-managed Community Edition and Enterprise Edition instances, fixing 18 vulnerabilities including a critical issue tracked as `CVE-2024-6678` with a CVSS score of 9.9. The flaw could let an attacker trigger a CI/CD pipeline as an arbitrary user and perform a stop action under certain conditions. GitLab said GitLab.com is already running the patched version and GitLab Dedicated customers do not need to take action. The release also fixes several high-severity bugs, including command injection into a connected Cube server via YAML configuration (`CVE-2024-8640`), server-side request forgery through Maven Dependency Proxy requests to internal resources (`CVE-2024-8635`), and a denial-of-service condition caused by a crafted POST request or large `glm_source` parameter (`CVE-2024-8124`). Additional medium-severity patches address token and session abuse, permission bypasses, information disclosure, and open redirects that could contribute to account takeover through broken OAuth flows, and GitLab urged all self-managed administrators to upgrade immediately.
Jul 24, 2026