Loading vulnerability…
A critical vulnerability in GitLab Community Edition and Enterprise Edition allows an attacker, under certain circumstances, to trigger a CI/CD pipeline as an arbitrary user. The issue affects all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2. The flaw results in pipeline execution occurring with the identity and effective permissions of a different user than the attacker, creating a privilege boundary failure in pipeline initiation and execution context. Available reporting does not provide sufficient verified detail about the exact vulnerable component or function to state a precise root-cause classification beyond the arbitrary-user pipeline trigger behavior.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python proof-of-concept for CVE-2024-6678 affecting GitLab pipeline schedules. It contains two files: a single exploit script (CVE-2024-6678-poc.py) and a README describing the vulnerability, prerequisites, curl reproduction steps, and example usage. The Python script uses only standard-library modules (argparse, json, urllib, time, sys) and is structured into helper/request functions, reconnaissance functions, exploitation functions, and a main CLI entry point. The helper layer builds authenticated REST requests to /api/v4/* using the PRIVATE-TOKEN header and GraphQL requests to /api/graphql using a Bearer token. Recon functions retrieve the current user, enumerate project pipeline schedules, and fetch schedule details. Exploitation is implemented through two paths: a REST trigger using POST /api/v4/projects/:id/pipeline_schedules/:sid/play and a GraphQL mutation pipelineSchedulePlay. After triggering, the script checks recent scheduled pipelines to confirm success. Core capability: the exploit allows a Developer-level user in a vulnerable GitLab project to trigger a pipeline schedule owned by a more privileged user. The resulting pipeline runs as the attacker/current user but inherits the schedule's configured variables, which may include secrets such as credentials, tokens, or SSH keys. The script is therefore an operational exploit for privilege abuse/secret exposure through CI/CD execution context, not merely a detector. It does not itself include a reverse shell or post-exploitation payload; instead, its impact comes from causing GitLab CI jobs to execute with inherited sensitive variables. The README indicates affected GitLab CE/EE versions up to 17.1.6 / 17.2.4 / 17.3.1, requires Developer access plus an existing active schedule, and notes that protected refs may block exploitation with HTTP 403 while unprotected refs are viable. It also mentions a legacy-ref bypass/exploit mode. Overall, the repository purpose is to demonstrate and automate unauthorized triggering of privileged GitLab pipeline schedules via REST or GraphQL.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously discovered vulnerability affecting GitLab import functionality that motivated GitLab to redesign importer user contribution mapping.
Critical GitLab CE and EE vulnerability that allows an attacker to run a pipeline with the permissions of an arbitrary user.
A critical GitLab CE/EE vulnerability that allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.
A critical command injection vulnerability in GitLab CE/EE that can allow triggering a pipeline as an arbitrary user under specific conditions, potentially leading to full system compromise and privilege escalation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.