Loading vulnerability…
Protected CI Variable Exfiltration via CI Lint in GitLab CE/EE
A vulnerability in GitLab CE/EE (from 17.0 before 17.6.4, from 17.7 before 17.7.3, and from 17.8 before 17.8.1) allows users with the developer role to exfiltrate protected CI variables through the CI lint feature under certain conditions. This bypasses intended access controls on sensitive CI/CD variables.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers with developer privileges can access and exfiltrate protected CI variables, which may include secrets, credentials, or other sensitive information intended to be restricted. This could lead to further compromise of CI/CD pipelines or associated infrastructure.
If you can’t patch tonight, do this now.
Restrict developer access to projects with sensitive CI variables until patched. Audit CI variable usage and access logs for suspicious activity. Consider rotating secrets stored in protected CI variables.
Patch, then assume compromise.
Upgrade GitLab CE/EE to version 17.6.4, 17.7.3, 17.8.1 or later, where the vulnerability has been addressed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.