CVE-2025-11246 Overview
GitLab patched an authorization flaw in GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed authenticated users to remove project runners from unrelated projects. The issue stems from improper handling of runner association requests through the GraphQL API. An attacker with specific project permissions could manipulate GraphQL mutations to disassociate runners belonging to projects they do not own. The vulnerability affects all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1. GitLab addressed the issue in patch release 18.7.1 published on January 7, 2026.
Critical Impact
Authenticated users can disrupt continuous integration pipelines by removing all project runners from unrelated projects through crafted GraphQL requests.
Affected Products
- GitLab CE/EE versions 15.4 through 18.5.4
- GitLab CE/EE versions 18.6.0 through 18.6.2
- GitLab CE/EE version 18.7.0
Discovery Timeline
- 2026-01-07 - GitLab releases patch 18.7.1 addressing the issue
- 2026-01-09 - CVE-2025-11246 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11246
Vulnerability Analysis
The flaw is categorized under [CWE-1220] Insufficient Granularity of Access Control. GitLab's GraphQL API exposes mutations that manage the association between CI/CD runners and projects. The affected mutations failed to properly verify that the requesting user held sufficient permissions on the target project before processing runner disassociation requests. An authenticated user with limited permissions could invoke these GraphQL operations against arbitrary projects. The result is unauthorized removal of project runners, which halts scheduled builds, deployments, and automated tests dependent on those runners.
Root Cause
The root cause lies in missing or incomplete authorization checks within the GraphQL resolver responsible for runner-project association changes. The resolver enforced authentication but did not fully validate whether the caller possessed maintainer or owner privileges on the affected project. This gap between authentication and authorization allowed cross-project tampering by any authenticated user meeting the low permission bar.
Attack Vector
Exploitation requires network access to a GitLab instance and valid authenticated credentials with basic project permissions. The attacker crafts a GraphQL mutation targeting the runner association endpoint and supplies identifiers for projects they do not administer. No user interaction is required beyond issuing the API request. Refer to the GitLab Issue #573728 and HackerOne Report #3292475 for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-11246
Indicators of Compromise
- Unexpected removal of project runners from GitLab projects, especially across unrelated project boundaries
- GraphQL API requests to runner association mutations originating from user accounts without maintainer privileges on the targeted project
- Sudden failures in CI/CD pipelines due to missing or unassociated runners
Detection Strategies
- Audit GitLab application logs and GraphQL query logs for mutations affecting runner-project associations
- Correlate runner removal events with the acting user's role on the target project to surface privilege mismatches
- Establish a baseline of expected runner association changes and alert on deviations
Monitoring Recommendations
- Forward GitLab audit events and API request logs to a centralized SIEM for correlation and retention
- Monitor project settings changes and CI/CD configuration modifications for anomalous patterns
- Track authenticated GraphQL activity from low-privilege accounts targeting administrative mutations
How to Mitigate CVE-2025-11246
Immediate Actions Required
- Upgrade GitLab CE/EE to version 18.5.5, 18.6.3, or 18.7.1 depending on the deployed release branch
- Review recent runner association changes and restore any runners that were removed without authorization
- Audit user accounts and revoke elevated permissions that are no longer required
Patch Information
GitLab addressed the issue in patch release 18.7.1 on January 7, 2026, with corresponding backports to 18.5.5 and 18.6.3. Administrators should consult the GitLab Patch Release 18.7.1 advisory for upgrade instructions and verify the running version after patching.
Workarounds
- No official workaround has been published; upgrading to a patched release is the recommended remediation
- Restrict access to the GitLab GraphQL API where feasible using network controls or authentication proxies until patching is complete
- Reduce the number of authenticated users with project-level access to limit the population capable of invoking the vulnerable mutation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
