GitLab patches critical pipeline execution flaw in self-managed CE/EE

GitLab released security updates 17.3.2, 17.2.5, and 17.1.7 for self-managed Community Edition and Enterprise Edition to fix multiple vulnerabilities, including the critical CVE-2024-6678. GitLab said the flaw can let an attacker trigger a pipeline as an arbitrary user under certain circumstances and assigned it a CVSS 9.9, urging customers to upgrade immediately. GitLab.com had already been patched, and GitLab Dedicated customers did not need to take action.

The patch bundle also addressed three high-severity issues and numerous medium- and low-severity flaws affecting pipelines, Product Analytics, Dependency Proxy, OAuth flows, CI/CD variables, repository mirroring, and access controls. A separate CVE entry for CVE-2024-8640 was listed without public details, while GitLab also noted one issue involving arbitrary unclaimed provider identities had not yet received a CVE at the time of publication.