Introduction
An attacker with valid credentials on a GitLab Enterprise Edition instance could have hijacked runners that belong to other projects. That would expose sensitive CI/CD secrets and let the attacker disrupt software delivery pipelines. The vulnerability is tracked as CVE-2025-11702. It carries a CVSS score of 8.5, which makes it a high risk for enterprises that run their DevOps workflows on GitLab.
GitLab is a DevOps platform that tens of thousands of organizations use for source code management, CI/CD, and project collaboration. Its Enterprise Edition adds features for large teams and regulated industries, which raises the stakes of any vulnerability in it.
Technical Information
CVE-2025-11702 is an improper access control vulnerability in the Runner API of GitLab Enterprise Edition. It affects all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1. The cause is missing or insufficient authorization checks (CWE-862) in the Runner API, which let authenticated users with specific permissions access, and potentially hijack, runners belonging to other projects.
The attacker must be authenticated and hold certain project-level permissions. With those, they could use the Runner API in a way that bypassed the intended project boundaries and take control of runners registered to other projects. The consequences could include:
- Unauthorized access to CI/CD secrets and environment variables from other projects
- Running arbitrary jobs or code in the context of another project
- Lateral movement within the GitLab instance, which may lead to broader compromise
The API endpoints that manage runners did not validate permissions strictly enough, so a user with legitimate access to one project could act on runners outside their authorization scope. The vulnerability is closely related to CWE-862 (Missing Authorization), which covers failures to enforce authorization checks before allowing access to sensitive resources.
As of the patch date, no public code snippets or exploit scripts had been released for this vulnerability. The mechanism itself is well understood, since it follows the familiar pattern of improper access control flaws in API-driven platforms.
Patch Information
The GitLab 18.5.1 release fixed several critical security vulnerabilities:
-
Improper Access Control in Runner API (CVE-2025-11702): Authenticated users with specific permissions could hijack project runners from other projects. The patch introduced stricter permission checks in the Runner API so that only authorized users can manage project runners.
-
Denial of Service in Event Collection (CVE-2025-10497): Unauthenticated users could send specially crafted payloads to cause a denial of service. The fix added validation that detects and rejects malicious payloads before they can disrupt the service.
-
Denial of Service in JSON Validation (CVE-2025-11447): Crafted JSON payloads in GraphQL requests could cause a denial of service. The update improved JSON parsing and validation so these payloads are handled safely.
-
Denial of Service in File Uploads (CVE-2025-11974): Unauthenticated users could upload large files to specific API endpoints and cause a denial of service. The patch introduced file size limits and authentication checks to stop unauthorized large uploads.
-
Incorrect Authorization in Pipeline Builds (CVE-2025-11971): Authenticated users could trigger unauthorized pipeline executions by manipulating commits. The fix tightened authorization checks so that only permitted users can start pipeline builds.
-
Business Logic Error in Group Memberships (CVE-2025-6601): Authenticated users could gain unauthorized project access by exploiting the access request approval workflow. The update corrected the approval logic to block that path.
-
Missing Authorization in Quick Actions (CVE-2025-11989): Authenticated users could run unauthorized quick actions by putting malicious commands in specific descriptions. The patch added authorization checks to quick actions so that only authorized commands run.
Patch source: GitLab 18.5.1 Patch Release
Affected Systems and Versions
- GitLab Enterprise Edition (EE) versions from 17.1 before 18.3.5
- GitLab EE 18.4 before 18.4.3
- GitLab EE 18.5 before 18.5.1
Community Edition (CE) is not affected. Only self-managed and enterprise deployments running the versions above are vulnerable. GitLab.com and GitLab Dedicated have already been patched, so customers on those platforms are not affected.
Vendor Security History
GitLab has had several high- and critical-severity vulnerabilities in recent years, especially around CI/CD runners and access control. Earlier issues include:
- Runner hijacking vulnerabilities on shared macOS runners (HackerOne report)
- Malicious runner vulnerabilities allowing job theft or unauthorized code execution (Cycode analysis)
- Multiple improper access control and authorization bypass issues
GitLab runs a public security release process and usually answers critical vulnerabilities with dedicated patch releases. It uses HackerOne for coordinated disclosure, and its practice is to publish security advisories and patches within weeks of a report. Both point to a mature vulnerability management process.
