CVE-2023-6955: GitLab Authorization Bypass Vulnerability

CVE-2023-6955 Overview

CVE-2023-6955 is a missing authorization check vulnerability in GitLab Remote Development. The flaw affects GitLab Community Edition (CE) and Enterprise Edition (EE) across multiple release branches. An attacker can create a workspace in one group that is associated with an agent belonging to a different group. This breaks the expected tenant boundary between GitLab groups and their associated Kubernetes agents. The weakness is tracked under CWE-862: Missing Authorization.

Critical Impact
An authenticated attacker can bypass group-level authorization controls in GitLab Remote Development to bind workspaces to agents owned by unrelated groups, undermining multi-tenant isolation.

Affected Products

GitLab CE/EE all versions prior to 16.5.6
GitLab CE/EE 16.6 prior to 16.6.4
GitLab CE/EE 16.7 prior to 16.7.2

Discovery Timeline

2024-01-12 - CVE-2023-6955 published to NVD
2025-05-05 - Last updated in NVD database

Technical Details for CVE-2023-6955

Vulnerability Analysis

GitLab Remote Development lets users provision cloud-based development workspaces backed by Kubernetes clusters registered through GitLab Agents. Each agent is scoped to a specific group or project. The Remote Development workflow is expected to verify that the user creating a workspace has permission to use the targeted agent. CVE-2023-6955 stems from the absence of that authorization check on the workspace creation path. The result is a broken access control issue mapped to CWE-862. The integrity impact is limited, but cross-group resource binding can corrupt billing, telemetry, and resource accounting boundaries.

Root Cause

The Remote Development service accepts a workspace creation request that references an agent identifier without confirming the requesting user has access to the group hosting that agent. Authorization was enforced at the workspace's parent group but not against the agent's owning group. This asymmetric check lets an attacker satisfy the workspace-side policy while side-stepping the agent-side policy.

Attack Vector

The attack requires network access to a vulnerable GitLab instance and an authenticated session. The attacker creates a workspace inside a group they control and supplies the identifier of an agent registered in a different group. Because no authorization check ties the workspace's parent group to the agent's owning group, the server provisions the cross-group binding. Refer to the GitLab Issue Report for further technical context. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2023-6955

Indicators of Compromise

Workspace records in GitLab Remote Development referencing an agent_id that belongs to a group outside the workspace's parent group hierarchy.
Audit log entries showing workspace creation events where the actor lacks Developer or higher role on the agent's owning group.
Unexpected Kubernetes pods or namespaces appearing on agents registered to groups whose members did not initiate the workload.

Detection Strategies

Query the GitLab database or API for workspaces and join with cluster_agents to surface cross-group workspace-to-agent associations.
Review GitLab audit events for remote_development workspace creation actions and correlate the actor's group membership with the agent's owning namespace.
Inspect Kubernetes agent telemetry for workspace provisioning calls that originate from user identities outside the agent's expected user base.

Monitoring Recommendations

Forward GitLab application and audit logs to a centralized SIEM and alert on Remote Development API calls referencing agents outside the actor's group scope.
Track GitLab version inventory across self-managed instances to confirm patched releases are deployed and remain in service.

How to Mitigate CVE-2023-6955

Immediate Actions Required

Upgrade GitLab CE/EE to 16.5.6, 16.6.4, 16.7.2, or later as documented in the GitLab Issue Report.
Audit existing Remote Development workspaces and remove any that are bound to agents outside the workspace's group hierarchy.
Rotate GitLab Agent tokens for agents that may have been bound to unauthorized workspaces.

Patch Information

GitLab addressed CVE-2023-6955 by adding the missing authorization check on the Remote Development workspace creation path. Fixed versions are GitLab 16.5.6, 16.6.4, and 16.7.2. GitLab.com SaaS users received the fix automatically. Self-managed administrators must upgrade their instances. Full release details are available in the GitLab Issue Report.

Workarounds

Disable the Remote Development feature on affected self-managed GitLab instances until patches are applied.
Restrict GitLab Agent registration to a limited set of trusted groups and remove unused agents to shrink the cross-group attack surface.
Limit user access to groups containing sensitive GitLab Agents until the upgrade is complete.

bash

# Verify the installed GitLab version on a self-managed instance
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Example upgrade path for Omnibus GitLab on Debian/Ubuntu
sudo apt-get update
sudo apt-get install gitlab-ee=16.7.2-ee.0
sudo gitlab-ctl reconfigure