Loading vulnerability…
Authorization Bypass in GitLab Pipeline Authorization Logic
CVE-2024-5258 is an authorization vulnerability in GitLab Community Edition and Enterprise Edition affecting versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. The flaw affects pipeline authorization logic associated with the Set Pipeline Status of a Commit API. An authenticated attacker can use a crafted naming convention, including conditions involving mismatched SHA and pipeline identifier handling, to bypass intended authorization checks. This can cause GitLab to incorrectly accept operations that should have been rejected by normal pipeline access-control enforcement.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to bypass pipeline authorization logic and perform unauthorized actions in the affected pipeline status workflow. The resulting impact is an integrity and confidentiality issue within GitLab’s CI/CD context, as unauthorized manipulation or access related to pipeline status handling may occur where normal permission boundaries should apply.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure to the affected API and tightly restrict which authenticated users and integrations can invoke pipeline-related status operations. Review and limit access to CI/CD and commit status workflows, monitor for anomalous pipeline status changes, and apply compensating access controls until an upgrade can be completed. Complete mitigation information beyond upgrading is not fully available.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. Patched versions include 16.10.6, 16.11.3, and 17.0.1 or later. Self-managed deployments should be updated to one of these releases or a newer maintained version that includes the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.