Loading vulnerability…
GitLab CE/EE Merge Request Pipeline Creation Race Condition
CVE-2024-11222 is a race condition in merge-request pipeline creation in GitLab Community Edition and Enterprise Edition. Under certain conditions, the flaw could allow an authenticated Developer to perform actions in the context of another user's merge-request commit. GitLab CE/EE versions from 13.0 before 19.1.8, 19.2.6, and 19.3.2 are affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A successful exploit can violate authorization boundaries and compromise merge-request pipeline integrity by allowing a Developer to act in the context of another user’s merge-request commit.
If you can’t patch tonight, do this now.
No specific workaround is available. Restrict Developer access to trusted users, apply least-privilege project membership, and monitor merge request pipeline activity for anomalous actions until the update is deployed.
Patch, then assume compromise.
Upgrade GitLab CE/EE to 19.1.8 or later on the 19.1 release line, 19.2.6 or later on the 19.2 release line, or 19.3.2 or later on the 19.3 release line.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.