Loading vulnerability…
Prohibited Branch Check Bypass in GitLab
CVE-2023-5226 is a vulnerability in GitLab affecting all versions before 16.4.3, 16.5 before 16.5.3, and 16.6 before 16.6.1. The vulnerability allows a malicious actor to bypass prohibited branch checks by using a specially crafted branch name. This enables manipulation of repository content via the GitLab UI, even when certain branch protections are in place.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can bypass branch protection mechanisms, potentially pushing unauthorized changes to protected branches. This could lead to unauthorized code changes, disruption of CI/CD pipelines, or introduction of malicious code into critical branches.
If you can’t patch tonight, do this now.
As a temporary mitigation, restrict repository access to trusted users only and monitor for suspicious branch names or activity until the patch can be applied.
Patch, then assume compromise.
Upgrade GitLab to version 16.4.3, 16.5.3, 16.6.1 or later, where the issue has been patched.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.