Loading vulnerability…
GitLab EE Webhook Deletion Audit Log Credential Retention
CVE-2024-7586 is an information-exposure vulnerability in GitLab Enterprise Edition (EE). When a webhook is deleted, the associated audit-log entry can retain authentication credentials rather than omitting or sanitizing them. It affects GitLab EE 17.0 before 17.0.6, 17.1 before 17.1.4, and 17.2 before 17.2.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Authentication credentials may remain in webhook-deletion audit records. Parties with access to the affected audit-log data could potentially obtain credentials that should not have been retained.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to GitLab audit logs and administrative interfaces to minimize exposure of retained credentials. Avoid unnecessary webhook deletion operations until the instance is upgraded, and proactively rotate webhook authentication credentials where exposure is suspected. Additional compensating controls may include tighter monitoring of audit-log access and review of integrations that rely on webhook secrets.
Patch, then assume compromise.
Upgrade GitLab EE to 17.0.6, 17.1.4, 17.2.2, or a later supported release containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.