GitLab: improper redirect validation in the Kubernetes proxy sends cluster auth tokens to an attacker-chosen server

Impact

GitLab's Kubernetes proxy follows redirects without validating the target, so a user who controls a registered Kubernetes agent can cause GitLab to forward sensitive authentication tokens to a server of their choosing. In a GPU estate where GitLab drives cluster access - agent-based deployments onto the training or inference clusters - the leaked token is a credential against the cluster or against GitLab itself, in the hands of whoever registered the agent. Scope is marked changed because the token belongs to a different trust domain than the agent that triggers the leak. Exploitation requires user interaction and the advisory rates attack complexity high, so this is credential hygiene work rather than an emergency.

Who can reach it

An authenticated GitLab user who controls a Kubernetes agent connected to the instance, plus interaction from the victim whose token is proxied.

What to do

Upgrade self-managed GitLab to 19.4.2, 19.3.5 or 19.2.8 and restart the instance - a maintenance window on the GitLab application tier, no GPU node drain. After patching, rotate Kubernetes agent tokens and any cluster credentials that could have been proxied, and review which users can register agents.

References

Related entries

• DMTF libspdm - SPDM Requester timeout handling: A libspdm Requester stores the Responder's CTExponentCVE-2023-32690 · DMTF libspdm - SPDM Requester timeout handlingMedium
• Dell OpenManage Enterprise (path traversal): An unauthenticated remote attacker reads files from the OME serverCVE-2024-25944 · Dell OpenManage Enterprise (path traversal)Medium
• Elastic Metricbeat: oversized Prometheus remote_write request drives an unbounded allocation and kills the beatCVE-2026-26931 · Elastic Metricbeat (Prometheus remote_write HTTP handler)Medium
• AMD Zen 1 / Zen 2 / Zen 3 - execution unit scheduler queue contention (SMT): AMD's split scheduler design gives eachCVE-2021-46778 · AMD Zen 1 / Zen 2 / Zen 3 - execution unit scheduler queue contention (SMT)Medium
• IBM Spectrum Scale / GPFS node file access path: An unprivileged but authenticated user on a GPFS node reads arbitraryCVE-2018-1723 · IBM Spectrum Scale / GPFS node file access pathMedium
• IBM GPFS command line utility: Any unprivileged user with a shell on a GPFS node can force GPFS down on that nodeCVE-2018-1783 · IBM GPFS command line utilityMedium