CVE-2024-8970

What it actually does

The flaw bypasses authorization controls in the pipeline scheduling logic, allowing an authenticated user to initiate a CI/CD pipeline that executes with the identity and permissions of a different user.

Why it matters to the business

Attackers can execute arbitrary build, test, and deployment jobs under another user's context, potentially leading to unauthorized code changes, secret exposure, or supply-chain tampering in shared development environments.

How an attack unfolds

An attacker with limited GitLab access crafts a request that references another user's pipeline definition or merge request; due to missing ownership or permission checks, the pipeline is enqueued and runs using the victim's credentials and environment variables.

How to fix it

Upgrade GitLab CE/EE to 17.2.9, 17.3.5, or 17.4.2 (or later) depending on the installed branch; apply the patch commit 91146650fd2d7d080662a536b1d04a5c96f451be where available.

How to confirm the fix worked

After upgrade, verify the running GitLab version matches a fixed release, review pipeline audit logs for unexpected owner changes, and confirm that pipeline creation requests now enforce strict user ownership checks.

Typical attack path

1. Obtain a low-privileged GitLab account in the target instance
2. Identify a project or merge request owned by a higher-privileged user
3. Craft and submit a pipeline trigger request that references the victim's context
4. Observe successful pipeline execution under the victim's identity
5. Leverage resulting artifacts, secrets, or deployment permissions

How to detect it

Search GitLab production logs and audit events for pipeline creation or scheduling requests where the initiating user differs from the pipeline owner or project maintainer; correlate with unusual deployment or secret-access activity.

What your security team should do

• Immediately schedule upgrade to the nearest fixed version for all GitLab instances
• Review CI/CD configuration to ensure pipelines do not rely on implicit user context
• Enable enhanced audit logging for pipeline creation events
• Monitor for any post-upgrade pipeline failures indicating misconfiguration