Loading vulnerability…
GitLab Pipeline Impersonation
CVE-2024-5655 is an authorization flaw in GitLab Community Edition and Enterprise Edition that can allow an attacker to trigger a CI/CD pipeline as another user under certain circumstances. It affects versions from 15.8 before 16.11.5, 17.0 before 17.0.3, and 17.1 before 17.1.1. The fix changes merge-request re-targeting behavior so pipelines do not automatically run when a merge request is automatically re-targeted after its prior target branch is merged.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker may cause a pipeline to be triggered under another user’s identity, potentially causing CI/CD actions to run in that user’s context.
If you can’t patch tonight, do this now.
Apply the GitLab security updates as soon as possible. If an immediate upgrade is not possible, review and restrict use of affected import functionality and merge-request workflows where feasible; complete remediation requires upgrading to a fixed release.
Patch, then assume compromise.
Upgrade GitLab CE/EE to 16.11.5, 17.0.3, 17.1.1, or a later applicable release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.