GitLab Patches Critical Pipeline Hijack and Multiple High-Severity Flaws

GitLab released security updates `17.3.2`, `17.2.5`, and `17.1.7` for self-managed Community Edition and Enterprise Edition to fix multiple vulnerabilities, including the critical `CVE-2024-6678`. GitLab said the flaw can let an attacker trigger a pipeline as an arbitrary user under certain circumstances and assigned it a `CVSS 9.9`, urging customers to upgrade immediately. GitLab.com had already been patched, and GitLab Dedicated customers did not need to take action. The patch bundle also addressed three high-severity issues and numerous medium- and low-severity flaws affecting pipelines, Product Analytics, Dependency Proxy, OAuth flows, CI/CD variables, repository mirroring, and access controls. A separate CVE entry for `CVE-2024-8640` was listed without public details, while GitLab also noted one issue involving arbitrary unclaimed provider identities had not yet received a CVE at the time of publication.

Sep 11, 2024

GitLab patches critical pipeline impersonation and multiple self-managed flaws

GitLab issued several security patch releases for Community Edition and Enterprise Edition to fix vulnerabilities affecting self-managed deployments, including two **critical pipeline impersonation flaws** that could let an attacker run CI/CD pipeline jobs as another user. The issues were tracked as `CVE-2024-5655` and `CVE-2024-6385`, with the latter included alongside fixes for group URL modification, deploy token creation, package registry manifest confusion, group member banning, and GitLab Pages subdomain takeover. GitLab said **GitLab.com** and **GitLab Dedicated** were already running patched versions and reported no evidence of abuse of `CVE-2024-5655` on GitLab-managed platforms. Subsequent patch releases addressed additional high- and medium-severity weaknesses, including stored cross-site scripting in Asciidoctor rendering (`CVE-2025-0314`), CI/CD variable exfiltration through CI lint (`CVE-2024-11931`), denial of service via cyclic epic references (`CVE-2024-6324`), access token exposure in logs, unauthorized issue status changes in public projects, and an Instance SAML configuration flaw that could expose internal projects or groups. GitLab also changed importer behavior after earlier importer-related problems, adding post-import mapping and user acceptance controls, and warned self-managed administrators using Direct Transfer, GitHub, Bitbucket Server, or Gitea importers to disable those features until upgraded.

Jan 22, 2025

GitLab Security Patches Fix High-Severity WebSocket and DoS Flaws

GitLab released security updates for Community Edition and Enterprise Edition, shipping versions **18.10.3**, **18.9.5**, and **18.8.9** to address multiple vulnerabilities tracked as `CVE-2026-5173`, `CVE-2026-1092`, `CVE-2025-12664`, and `CVE-2026-1101`. The patched issues include a high-severity flaw that could allow unintended server-side method invocation over WebSocket connections, along with several denial-of-service weaknesses affecting the Terraform state lock API and the GraphQL API. The release also fixes medium- and low-severity bugs including cross-site scripting in analytics dashboards, code-injection-related IP leakage in Code Quality reports, authorization weaknesses in APIs and custom roles, and information disclosure through GraphQL queries and CSV export. GitLab said **GitLab.com** had already been patched, **GitLab Dedicated** customers did not need to take action, and self-managed customers should upgrade immediately; the company added that the updates require no new migrations and should not cause downtime in multi-node deployments.

Apr 8, 2026

GitLab Patches Critical Pipeline Hijack and Multiple High-Severity Flaws

How this story unfolded

GitLab releases critical security patches for CE and EE

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

GitLab Patches Critical Pipeline Hijack and Multiple High-Severity Flaws

How this story unfolded

GitLab releases critical security patches for CE and EE

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

GitLab Patches Critical Pipeline Hijack and Multiple High-Severity Flaws

How this story unfolded

GitLab releases critical security patches for CE and EE

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches critical pipeline execution flaw in self-managed CE/EE

GitLab patches critical pipeline impersonation and multiple self-managed flaws

GitLab Security Patches Fix High-Severity WebSocket and DoS Flaws

GitLab Patches Critical Pipeline Hijack and Multiple High-Severity Flaws

How this story unfolded

GitLab releases critical security patches for CE and EE

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches critical pipeline execution flaw in self-managed CE/EE

GitLab patches critical pipeline impersonation and multiple self-managed flaws

GitLab Security Patches Fix High-Severity WebSocket and DoS Flaws