CVE-2024-7586: GitLab Information Disclosure Vulnerability

CVE-2024-7586 Overview

CVE-2024-7586 affects GitLab Enterprise Edition (EE) across multiple release branches. The flaw stems from the webhook deletion audit log retaining authentication credentials after a webhook is removed. An unauthenticated network-based attacker who gains access to audit log data can recover sensitive credentials stored alongside webhook deletion events. The issue is tracked under CWE-532: Insertion of Sensitive Information into Log File.

Critical Impact

Webhook authentication credentials persist in GitLab audit logs after deletion, exposing secrets that can be reused to access third-party systems integrated through webhooks.

Affected Products

• GitLab EE versions 17.0 prior to 17.0.6
• GitLab EE versions 17.1 prior to 17.1.4
• GitLab EE versions 17.2 prior to 17.2.2

Discovery Timeline

• 2025-06-20 - CVE-2024-7586 published to NVD
• 2025-08-12 - Last updated in NVD database

Technical Details for CVE-2024-7586

Vulnerability Analysis

GitLab webhooks support authentication headers and secret tokens used to verify requests sent to external endpoints. When an administrator deletes a webhook, GitLab records the action in the audit log for compliance and traceability. The vulnerability arises because the deletion audit entry stores the full webhook configuration, including authentication credentials, in cleartext.

Any user with permission to view audit logs can therefore retrieve credentials that should have been discarded with the webhook itself. The credentials remain available for the retention period of the audit log, which often spans months or years in enterprise deployments. Attackers who obtain audit log access through credential theft, privilege escalation, or backup exposure can extract these secrets and pivot to downstream systems.

The vulnerability is classified under [CWE-532] and reflects an information disclosure issue rather than a code execution flaw. GitLab tracked the issue publicly in GitLab Issue 463866.

Root Cause

The audit logging routine serializes the entire webhook object during deletion events. The serializer does not redact or mask the credential fields before persisting the log entry. As a result, secrets that are normally encrypted at rest in the webhook configuration become readable in the audit trail.

Attack Vector

Exploitation requires access to GitLab audit log data. An attacker with audit reader privileges, access to exported log archives, or read access to the underlying database can query deletion events and recover the embedded credentials. The credentials can then be replayed against the third-party services that the webhook originally targeted.

No verified public exploit code is available for this issue. The vulnerability mechanism is described in the linked GitLab issue tracker.

Detection Methods for CVE-2024-7586

Indicators of Compromise

• Audit log entries of type destroy_hook or webhook_destroy containing populated token, url, or authorization fields.
• Unexpected queries against the audit_events table targeting webhook-related event types.
• Exports or downloads of audit log archives by accounts that do not normally perform compliance reviews.

Detection Strategies

• Review historical audit log entries on affected GitLab versions for webhook deletion events that include credential fields.
• Correlate audit log access patterns with administrative role assignments to identify abnormal viewers of webhook deletion events.
• Monitor outbound authentication failures on third-party services that previously received webhook traffic, which may indicate replay attempts.

Monitoring Recommendations

• Alert on bulk reads of the GitLab audit log API, especially filters scoped to webhook entity types.
• Track access to GitLab database backups and snapshot exports that contain historical audit data.
• Log and review changes to audit log retention policies that could extend exposure of leaked credentials.

How to Mitigate CVE-2024-7586

Immediate Actions Required

• Upgrade GitLab EE to version 17.0.6, 17.1.4, 17.2.2, or later, depending on the deployed branch.
• Rotate all webhook authentication tokens and secrets that were configured on affected GitLab instances prior to upgrading.
• Purge or sanitize historical audit log entries for webhook deletion events where retention policies allow.

Patch Information

GitLab released fixes in versions 17.0.6, 17.1.4, and 17.2.2. The patches modify the audit logging routine to exclude credential fields from serialized webhook deletion events. Refer to the GitLab issue discussion for engineering context.

Workarounds

• Restrict audit log access to a minimal set of compliance and security personnel using GitLab role-based access control.
• Shorten audit log retention windows on affected instances until upgrades complete, reducing the credential exposure window.
• Replace static webhook tokens with short-lived credentials or OAuth integrations where the receiving service supports them.

# Verify installed GitLab version and confirm patched release
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Example upgrade path on an Omnibus-based deployment
sudo apt-get update && sudo apt-get install gitlab-ee=17.2.2-ee.0
sudo gitlab-ctl reconfigure