GitLab released security updates addressing CVE-2024-9164 (CVSS 9.6), a critical missing authentication vulnerability (CWE-306) across GitLab Community Edition and Enterprise Edition. The flaw enables unauthorized users to trigger Continuous Integration/Continuous Delivery (CI/CD) pipelines on arbitrary repository branches, including protected branches normally restricted to repository maintainers. Because the pipeline triggering mechanism failed to enforce access controls, attackers can dispatch malicious pipeline workflows that execute arbitrary code within configured runner environments and access protected CI/CD variables, cloud infrastructure tokens, and build artifacts.

The vulnerability affects GitLab versions 12.5 through 17.2.8, 17.3 through 17.3.4, and 17.4 through 17.4.1. Discovered by security researcher pwnie via HackerOne, the flaw was patched alongside CVE-2024-8970, a high-severity pipeline user impersonation bug. While no active exploitation was observed prior to disclosure, GitLab urged immediate upgrades to remediated releases (17.4.2, 17.3.5, and 17.2.9), warning that CI/CD pipelines operating on protected branches possess direct access to production deployment secrets.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Unchecked pipeline dispatch on protected branches collapses continuous delivery security perimeters, allowing adversaries to execute untrusted code with runner privileges and extract production secrets without modifying repository source code.
• Bullet 2 — Strategic & Defender Imperative: Organizations hosting self-managed GitLab instances must upgrade to patched releases immediately, audit CI/CD runner execution logs for unauthorized branch pipeline triggers, and isolate runner environments using ephemeral, zero-trust compute nodes.