CVE-2024-8116: GitLab Information Disclosure Vulnerability

CVE-2024-8116 Overview

CVE-2024-8116 is an authorization flaw in GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability affects all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An unauthorized user can retrieve branch names by issuing a specific GraphQL query under certain conditions. The issue is classified under [CWE-863] Incorrect Authorization and stems from missing access checks on a GraphQL resolver. Exploitation requires no authentication or user interaction and can be performed remotely over the network.

Critical Impact
Unauthorized remote users can enumerate repository branch names through crafted GraphQL queries, exposing internal development activity and code structure.

Affected Products

GitLab CE/EE versions 16.9 through 17.4.5
GitLab CE/EE versions 17.5 through 17.5.3
GitLab CE/EE versions 17.6 through 17.6.1

Discovery Timeline

2024-12-16 - CVE-2024-8116 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8116

Vulnerability Analysis

CVE-2024-8116 is a GraphQL API authorization flaw in GitLab. The vulnerability allows unauthorized actors to retrieve branch names from repositories they should not access. The flaw resides in the GraphQL query handling layer, which fails to enforce permission checks on branch enumeration under specific conditions.

Branch names commonly reveal sensitive information about internal projects. Attackers can infer feature development, ongoing security fixes, upcoming releases, and internal naming conventions. Disclosure of branch names supports reconnaissance for follow-on attacks against private repositories.

GitLab's GraphQL API exposes many resolvers that read repository metadata. When a resolver lacks a proper authorization guard, callers can bypass the standard REST access controls that would otherwise reject the request. This class of issue is documented as Incorrect Authorization [CWE-863] and is distinct from missing authentication.

Root Cause

The root cause is missing or incorrect authorization logic on a GraphQL resolver that returns branch data. Access controls that apply to REST endpoints are not consistently enforced across the GraphQL schema. Under specific conditions described in the GitLab issue tracker, the resolver returns branch names to callers who lack the required project permissions.

Attack Vector

An attacker sends a crafted GraphQL query to the target GitLab instance over the network. No authentication or user interaction is required. The query targets a resolver that returns branch metadata for a project. When the specific conditions are met, the server responds with branch names for projects the caller should not be able to enumerate. Technical query details are described in HackerOne Report #2666216.

Detection Methods for CVE-2024-8116

Indicators of Compromise

Unauthenticated or low-privilege POST requests to the /api/graphql endpoint containing branch enumeration fields such as repository, branchNames, or tree.
Elevated volumes of GraphQL queries from single source IP addresses targeting multiple project identifiers.
GraphQL requests with introspection queries followed by branch-related resolver calls.

Detection Strategies

Inspect web server and reverse proxy logs for anomalous request patterns against /api/graphql, especially from unauthenticated sessions.
Correlate GraphQL query bodies with expected user permissions and flag mismatches where anonymous callers receive branch metadata.
Deploy Web Application Firewall (WAF) rules that inspect GraphQL query payloads and rate-limit unauthenticated GraphQL traffic.

Monitoring Recommendations

Enable GitLab audit event logging and forward events to a centralized SIEM for retention and correlation.
Monitor for repeated 200 OK responses to unauthenticated GraphQL POST requests referencing project or branch objects.
Track baseline GraphQL request rates per source IP and alert on statistical deviations that suggest enumeration.

How to Mitigate CVE-2024-8116

Immediate Actions Required

Upgrade GitLab CE/EE to version 17.4.6, 17.5.4, 17.6.2, or later as documented in the GitLab issue.
Inventory all self-managed GitLab instances and confirm current version against the affected ranges.
Restrict network exposure of GitLab GraphQL endpoints to trusted networks where operationally feasible.

Patch Information

GitLab released fixed builds in versions 17.4.6, 17.5.4, and 17.6.2. Administrators of self-managed instances should apply the upgrade following standard GitLab upgrade procedures. GitLab.com SaaS tenants receive the fix automatically. Refer to the GitLab advisory for release notes and upgrade guidance.

Workarounds

No official workaround has been published; patching is the recommended path.
Where immediate patching is not possible, place the GitLab instance behind an authenticating reverse proxy that requires SSO before reaching /api/graphql.
Apply WAF rules that block unauthenticated GraphQL POST requests targeting branch resolvers.

bash

# Example NGINX snippet to restrict unauthenticated GraphQL access
location = /api/graphql {
    # Require an authenticated session cookie or token before proxying
    if ($http_authorization = "") { return 401; }
    proxy_pass http://gitlab_upstream;
}