Loading vulnerability…
Cross-project access in GitLab EE Security policy bot
CVE-2024-6356 is a permission-check vulnerability in GitLab Enterprise Edition that affects the Security policy bot. In affected versions, the bot could be granted access across project boundaries, allowing unintended cross-project access. The issue affects GitLab EE versions starting from 16.0 before 17.0.6, starting from 17.1 before 17.1.4, and starting from 17.2 before 17.2.2. The flaw is described as a cross-project access condition tied to the Security policy bot rather than a memory-safety issue or code-execution bug, indicating improper authorization enforcement for bot access scope.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized cross-project access by the Security policy bot. This can break project isolation boundaries and may expose project resources or security-policy-related operations to contexts outside the intended project scope. Based on the available information, the primary impact is unauthorized access across projects rather than direct remote code execution or full administrative compromise.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting use of Security policy bot functionality to only necessary projects and tightly limiting project relationships and permissions involving security policy features until the upgrade can be completed. Because the available information does not provide an official vendor workaround, upgrading is the primary mitigation.
Patch, then assume compromise.
Upgrade GitLab EE to a fixed release. Patched versions are 17.0.6, 17.1.4, and 17.2.2 or later, depending on the deployed release train. Self-managed installations running affected versions should be updated immediately.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.