CVE-2024-11222: GitLab CE/EE Race Condition Vulnerability

CVE-2024-11222 Overview

CVE-2024-11222 is a race condition vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 13.0 before 19.1.8, versions 19.2 before 19.2.6, and versions 19.3 before 19.3.2. Under specific conditions, a developer-level user can perform actions in the context of another user's merge request commit due to a timing flaw in pipeline creation. The issue is categorized as a Time-of-Check Time-of-Use (TOCTOU) weakness [CWE-367]. GitLab remediated the vulnerability across the affected release branches.

Critical Impact
An authenticated developer user can exploit a race condition in pipeline creation to execute merge request actions in another user's context, resulting in unauthorized confidentiality and integrity impact on target projects.

Affected Products

GitLab CE/EE versions 13.0 through 19.1.7
GitLab CE/EE versions 19.2 through 19.2.5
GitLab CE/EE versions 19.3 through 19.3.1

Discovery Timeline

2026-09-16 - CVE-2024-11222 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2024-11222

Vulnerability Analysis

The vulnerability resides in GitLab's pipeline creation logic tied to merge requests. When a developer-privileged user triggers pipeline creation, a race condition allows their action to bind to another user's merge request commit. The result is that operations execute under a different user's identity and permissions. This crosses a trust boundary between distinct project contributors and undermines merge request integrity guarantees.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) flaw [CWE-367] in the pipeline creation code path. GitLab validates the actor and merge request state at one point, then acts on that state at a later point without an atomic guarantee. A concurrent request can alter the bound commit or execution context between the check and the use. The gap allows one developer's request to inherit context from another user's commit.

Attack Vector

Exploitation requires an authenticated user with developer role in the target project and user interaction on a competing merge request event. The attacker triggers pipeline creation timed against another user's commit activity to win the race. Successful exploitation grants the attacker action execution in the victim's context on the affected merge request. Attack complexity is high because the exploit depends on precise timing against concurrent pipeline events. Refer to the HackerOne Report #2797450 and GitLab Work Item #504395 for further technical background.

Detection Methods for CVE-2024-11222

Indicators of Compromise

Pipeline records where the triggering user does not match the author of the associated merge request commit.
Multiple pipeline creation events for the same merge request within a very short time window from different users.
Audit log entries showing merge request actions executed under an actor different from the expected assignee or committer.

Detection Strategies

Query GitLab audit events and CI pipeline metadata for mismatches between user_id and the merge request commit author on protected branches.
Alert on unexpected pipeline runs triggered against merge requests immediately after another user pushes a commit.
Correlate developer actions across projects to surface anomalous cross-user activity on the same merge request.

Monitoring Recommendations

Stream GitLab audit logs and Rails production logs to a centralized analytics platform for retention and query.
Track pipeline creation latency and concurrency to identify race attempts targeting merge request endpoints.
Review permission and role assignments on high-value repositories to reduce the pool of developer accounts that meet the exploitation preconditions.

How to Mitigate CVE-2024-11222

Immediate Actions Required

Upgrade GitLab CE/EE to version 19.1.8, 19.2.6, or 19.3.2 or later as applicable to your release branch.
Audit recent pipeline executions on protected branches for actor and commit-author mismatches.
Rotate any secrets or tokens that may have been exposed to pipelines triggered under an unintended user context.

Patch Information

GitLab released fixed versions 19.1.8, 19.2.6, and 19.3.2 that remediate the race condition in pipeline creation. Administrators should apply the update following the guidance in the GitLab Patch Release 19.3.2 advisory. Self-managed instances should be upgraded to the nearest patched version within their current release branch.

Workarounds

Restrict developer role assignments on sensitive projects until the upgrade is applied.
Enforce merge request approval rules and protected branch controls to limit who can trigger pipelines on merged commits.
Enable required pipeline approval or manual job gating on production-adjacent projects to reduce exposure to automated race exploitation.

bash

# Verify installed GitLab version and upgrade using the official package manager
# Debian/Ubuntu example:
sudo gitlab-rake gitlab:env:info | grep -i version
sudo apt-get update && sudo apt-get install gitlab-ee=19.3.2-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart