GitLab Enterprise Edition
CVE-2025-11702
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with specific project permissions
-
ExploitAbuse missing authorization check
-
ExecutionHijack another project's CI runner
-
ImpactExecute jobs and exfiltrate pipeline secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated GitLab Enterprise Edition account holding specific project-level permissions (per the description, 'specific permissions' - not anonymous and not merely any read access); the attacker then abuses a missing authorization control to seize project runners belonging to other projects. Exploitation is LIMITED to GitLab EE instances (Community Edition CPEs are not listed) running the affected versions (17.1 up to but not including 18.3.5, 18.4.x below 18.4.3, 18.5.0). Limiting factors: a valid authenticated session with the requisite permission level is mandatory (PR:L), reducing exposure versus a fully unauthenticated flaw, though no user interaction is needed and the attack is network-reachable. |
| Impact | The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) indicates a network-reachable, low-complexity flaw requiring only low-level authenticated privileges and no user interaction, with full compromise of confidentiality, integrity, and availability. This aligns with CWE-862 (Missing Authorization) and the description's note of 'an authenticated attacker with specific permissions.' No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV, and no public exploit was confirmed - a HackerOne report (#3356284) is referenced as the private disclosure channel but does not confirm published exploit code. Net assessment: this is a genuine priority for GitLab EE operators because of the low privilege bar and high impact (hijacking CI/CD runners can expose pipeline secrets and enable code execution across tenant/project boundaries), but there is no evidence of active or widespread exploitation, so it skews toward a patch-promptly rather than drop-everything emergency. One caveat: the vector is S:U (unchanged) even though cross-project runner hijacking arguably crosses an authorization boundary - defenders may wish to treat impact as broader than S:U implies. |
| Exploit ScenarioDerived | An attacker who holds a low-privilege but 'specific permission' authenticated role within a GitLab EE instance abuses a missing authorization check to claim or hijack CI/CD runners belonging to other, unrelated projects. By redirecting those runners, the attacker can run malicious jobs, harvest the victim projects' CI secrets and tokens, and tamper with their pipelines. No public exploit code is confirmed; the issue was reported privately via HackerOne. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
GitLab Enterprise Edition versions 17.1 through before 18.3.5, 18.4.x before 18.4.3, and 18.5.0 before 18.5.1 contain a missing authorization flaw (CWE-862) that lets an authenticated user with specific project-level permissions hijack project runners owned by other projects. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High), reflecting network reachability, low complexity, low-level authenticated access, no user interaction, and high confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade GitLab Enterprise Edition to 18.3.5, 18.4.3, or 18.5.1 (or later) according to your release line; the patch release advisory is https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/. If immediate upgrade is not possible, restrict runner management and registration permissions to the smallest set of trusted project maintainers/owners, audit existing runner ownership and assignment records for unexpected cross-project links, and monitor GitLab logs for anomalous runner registration or reassignment activity; these controls reduce exposure but do not fully remove the missing authorization flaw and may require temporary tightening of CI/CD workflows. Review the vendor issue https://gitlab.com/gitlab-org/gitlab/-/issues/576900 and HackerOne report https://hackerone.com/reports/3356284 for additional details.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GitLab CI/CD project runners are execution agents that build and deploy code, and their registration and assignment are governed by authorization checks. CVE-2025-11702 is classified as CWE-862 Missing Authorization, meaning the application fails to verify that an authenticated actor has the right to manage or claim a runner before allowing that action. Per the vendor, GitLab EE versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 are affected; the CPE data identifies gitlab:gitlab enterprise edition builds, including 18.5.0. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the issue is network-reachable, low-complexity, requires an authenticated session with low privileges, needs no user interaction, and can fully compromise confidentiality, integrity, and availability once the runner is hijacked.
Know when Gitlab gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web app (AV:N), no special timing (AC:L), requires an authenticated account with specific project permissions (PR:L), no victim interaction (UI:N); runner hijack yields full secret exposure and pipeline control (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects.
Executive ViewAI
GitLab Enterprise Edition deployments running the affected version ranges face a high-severity authorization flaw that can let an authenticated project user hijack runners owned by other projects. This puts CI/CD build integrity, code and secret confidentiality, and deployment availability at risk across teams relying on shared or neighboring project runners. Leadership should prioritize inventory and interim access controls because no vendor-released patch was identified at time of analysis and no public exploit was identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting runner registration and management to trusted administrators, minimizing project-level permissions that can affect runners, auditing runner ownership for unauthorized changes, rotating runner authentication tokens where feasible, isolating runners from sensitive networks and secrets, and monitoring for unexpected runner registration or ownership changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2)
Remote code execution in GitLab CE/EE can be triggered by a specially crafted regular expression processed through a vul
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer over
GitHub PoC
Exploit-DB