CVE-2024-8641: GitLab Auth Bypass Vulnerability

CVE-2024-8641 Overview

CVE-2024-8641 affects GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows an attacker who holds a victim's CI_JOB_TOKEN to obtain the victim's GitLab session token. Session token exposure enables full account takeover, granting the attacker access to repositories, pipelines, and administrative functions available to the compromised user.

The issue impacts all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. GitLab released patches on September 11, 2024, addressing the flaw across supported release branches. The vulnerability is classified under [CWE-270] (Privilege Context Switching Error).

Critical Impact
An attacker with a stolen CI_JOB_TOKEN can escalate to a full GitLab session, gaining access to source code, CI/CD secrets, and any resource the victim can reach.

Affected Products

GitLab CE/EE versions 13.7 through 17.1.6
GitLab CE/EE versions 17.2 through 17.2.4
GitLab CE/EE versions 17.3 through 17.3.1

Discovery Timeline

2024-09-11 - GitLab releases security patch (versions 17.1.7, 17.2.5, 17.3.2)
2024-09-12 - CVE-2024-8641 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8641

Vulnerability Analysis

GitLab's CI_JOB_TOKEN is a short-lived credential automatically injected into every CI/CD job. It exists to authenticate limited API calls made from a running pipeline, such as pulling container images from the project registry or triggering downstream jobs. By design, it operates in a restricted privilege context and should not grant access equivalent to the user who initiated the job.

This vulnerability breaks that boundary. An attacker who captures a victim's CI_JOB_TOKEN, such as through a compromised pipeline job, a malicious dependency, or a leaked log, can exchange it for a full GitLab session token. The session token grants interactive web-session privileges tied to the victim account.

The issue maps to [CWE-270] Privilege Context Switching Error, where an operation crosses trust boundaries without proper privilege re-evaluation. Because pipelines commonly run untrusted code from merge requests and forked branches, the exposure surface for CI_JOB_TOKEN is broad.

Root Cause

The root cause lies in improper isolation between the CI job authentication context and the user session authentication context. An API pathway accepted the CI_JOB_TOKEN in a context that then permitted issuance or exposure of a session token belonging to the token owner.

Attack Vector

The attack is network-based and requires low privileges. An attacker must first obtain the victim's CI_JOB_TOKEN. Common acquisition methods include reading tokens from misconfigured pipeline logs, injecting code into a shared runner, or compromising a third-party build dependency. The attacker then submits the token to the vulnerable GitLab endpoint and receives the victim's session token in response.

See the GitLab Issue #471954 and HackerOne Report #2595495 for the disclosure details. No public proof-of-concept exploit code was released.

Detection Methods for CVE-2024-8641

Indicators of Compromise

Unexpected authenticated GitLab web sessions originating from IP addresses associated with CI runners or container hosts.
API requests presenting a CI_JOB_TOKEN immediately followed by session-authenticated requests from a different network location.
New personal access tokens, SSH keys, or two-factor changes on user accounts shortly after pipeline execution.

Detection Strategies

Correlate CI_JOB_TOKEN usage in GitLab audit logs with subsequent session-cookie-authenticated requests from the same user identity.
Alert on GitLab session activity where the User-Agent, geolocation, or ASN diverges sharply from the user's historical baseline.
Review pipeline job logs for evidence of scripts reading environment variables such as CI_JOB_TOKEN and exfiltrating them over HTTP or DNS.

Monitoring Recommendations

Enable and centralize GitLab audit events, authentication events, and API request logs.
Monitor for privilege boundary crossings between job-scoped tokens and user-scoped sessions.
Track creation of new tokens, keys, and permission changes on any account whose pipelines have run untrusted or forked code.

How to Mitigate CVE-2024-8641

Immediate Actions Required

Upgrade GitLab CE/EE to version 17.1.7, 17.2.5, or 17.3.2 or later without delay.
Rotate active session tokens and personal access tokens for users whose pipelines ran on vulnerable versions.
Audit recent CI job logs for signs of CI_JOB_TOKEN exfiltration and review associated account activity.

Patch Information

GitLab issued fixes on September 11, 2024. Full details are available in the GitLab Release Patch Notes. Self-managed installations should apply the patch matching their current release branch. GitLab.com SaaS instances were patched by GitLab.

Workarounds

No official workaround exists; patching is the only supported remediation.
Restrict which projects can use a project's CI_JOB_TOKEN via the token access allowlist under CI/CD settings.
Limit pipeline execution on forks and merge requests from untrusted contributors until the upgrade is complete.

bash

# Verify GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Restrict CI_JOB_TOKEN scope (project setting via API)
curl --request PATCH \
  --header "PRIVATE-TOKEN: <admin_token>" \
  "https://gitlab.example.com/api/v4/projects/<project_id>/job_token_scope" \
  --data "enabled=true"