Loading vulnerability…
GitLab CE/EE pipeline execution as another user
A high-severity vulnerability in GitLab Community Edition and Enterprise Edition allows an attacker, under certain circumstances, to trigger a CI/CD pipeline as another user. The issue affects all versions starting from 11.6 before 17.2.9, starting from 17.3 before 17.3.5, and starting from 17.4 before 17.4.2. Available reporting ties the flaw to GitLab import functionality and indicates that exploitation can cause pipeline execution to occur with another user’s identity rather than the attacker’s own context, resulting in unauthorized actions within the CI/CD workflow.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause unauthorized pipeline execution under another user’s identity. This can lead to unauthorized actions in CI/CD processes, misuse of the impersonated user’s project permissions within pipeline-triggered operations, and potentially broader downstream effects depending on what the pipeline is configured to do.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable affected importers and related import functionality until the instance can be upgraded. Reported guidance specifically highlights risk in self-managed deployments with Direct Transfer, GitHub, Bitbucket Server, or Gitea importers enabled. Restricting who can use import features and limiting public self-registration can further reduce exposure.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release: 17.2.9, 17.3.5, 17.4.2, or a later patched version. Later GitLab releases also redesigned importer user contribution and membership mapping to reduce the class of importer-related user-mapping issues associated with this vulnerability family.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.