GitLab: Attacker can trigger a CI pipeline as another user

Impact

Attacker can trigger a CI pipeline as another user -> jobs run with that user's token

Who can reach it

Network (remote)

What to do

Control-plane: upgrade; rotate CI job and runner registration tokens

References

Related entries

• GitLab: Image files passed unvalidated to a file parser (ExifTool)CVE-2021-22205 · GitLabCritical
• GitLab: Unauthenticated path traversal reads arbitrary server files when an attachment sits under 5+ nested groupsCVE-2023-2825 · GitLabCritical
• GitLab: Password reset email deliverable to an unverified addressCVE-2023-7028 · GitLabCritical
• AAP Controller: testing a Vault credential sends the controller pod's service account token to an attacker URLCVE-2026-12564 · Red Hat Ansible Automation Platform Controller (awx_plugins HashiCorp Vault credential plugin)Critical
• Termix: any authenticated user can read other users' stored SSH and sudo passwordsCVE-2026-53548 · Termix (GET /host/db/host/:id/password credential endpoint)Critical
• Progress LoadMaster (ADC): OS command injection in the APICVE-2026-8037 · Progress LoadMaster (ADC)Critical