CVE-2025-11702: GitLab Auth Bypass Vulnerability

CVE-2025-11702 Overview

CVE-2025-11702 is a missing authorization vulnerability [CWE-862] in GitLab Enterprise Edition (EE). The flaw allows an authenticated attacker with specific project permissions to hijack project runners belonging to other projects. GitLab patched the issue across releases 18.3.5, 18.4.3, and 18.5.1. The vulnerability affects all EE versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1.

Critical Impact
An attacker can take control of CI/CD runners assigned to other projects, enabling execution of malicious pipelines, theft of secrets, and tampering with build artifacts across organizational boundaries.

Affected Products

GitLab Enterprise Edition versions 17.1 through 18.3.4
GitLab Enterprise Edition versions 18.4 through 18.4.2
GitLab Enterprise Edition version 18.5.0

Discovery Timeline

2025-10-22 - GitLab releases patch version 18.5.1 addressing the issue
2025-10-29 - CVE-2025-11702 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-11702

Vulnerability Analysis

The vulnerability stems from missing authorization checks on operations involving project runners. GitLab project runners are dedicated CI/CD executors scoped to a single project. The flawed endpoint accepted runner-related requests without verifying the requester's authority over the target project or runner. An authenticated user holding specific permissions within their own project could reference runners belonging to unrelated projects. This effectively re-assigns or activates a foreign runner under attacker control.

Once hijacked, the runner executes jobs defined by the attacker. CI/CD runners typically hold privileged credentials, deployment keys, and access to internal registries. The attacker can exfiltrate CI variables, modify build outputs, and pivot into connected infrastructure.

Root Cause

The root cause is an authorization gap classified under [CWE-862] Missing Authorization. The application layer enforced authentication but failed to validate object-level permissions on runner ownership. See GitLab Issue #576900 and the HackerOne Report #3356284 for additional technical context.

Attack Vector

Exploitation is performed over the network against a GitLab EE instance. The attacker requires an authenticated account with specific project-level permissions, but no user interaction from a victim. After authenticating, the attacker issues runner-management requests targeting runner identifiers tied to other projects. The server processes the request without scope validation and binds the runner to the attacker's controlled context.

No public proof-of-concept exploit code is available. The vulnerability mechanism is described in the linked vendor and HackerOne references.

Detection Methods for CVE-2025-11702

Indicators of Compromise

Unexpected changes to runner assignments in the ci_runners audit log, particularly runners appearing in projects where they were not previously registered.
CI/CD job executions on a project runner triggered by users without prior history of running pipelines on that runner.
Anomalous outbound network connections or secret access patterns originating from GitLab runner hosts.

Detection Strategies

Review GitLab audit events for runner registration, ownership transfer, and project assignment changes occurring before the upgrade to a patched version.
Correlate runner activity logs with user permission scopes to identify operations performed outside a user's authorized project boundaries.
Inspect CI pipeline definitions and job logs for unauthorized modifications, unexpected script execution, or attempts to access CI variables and deployment tokens.

Monitoring Recommendations

Enable verbose audit logging on /api/v4/runners and project runner administration endpoints.
Forward GitLab application and audit logs to a centralized SIEM for retention and behavioral analysis.
Alert on runner registration tokens used outside expected source IP ranges or project contexts.

How to Mitigate CVE-2025-11702

Immediate Actions Required

Upgrade GitLab Enterprise Edition to 18.3.5, 18.4.3, or 18.5.1 or later, depending on your current major version.
Rotate runner registration tokens and any CI/CD secrets exposed to potentially hijacked runners.
Audit runner-to-project assignments and remove any unauthorized associations introduced before patching.

Patch Information

GitLab released fixed builds on October 22, 2025. See the GitLab Patch Release 18.5.1 announcement for upgrade instructions and the full list of remediated issues. Self-managed administrators should apply the patch matching their installed branch, while GitLab.com is already updated.

Workarounds

No official workaround is published. Restrict project membership and roles to limit the population of users able to invoke the vulnerable endpoint until patching is complete.
Temporarily disable shared and reusable project runners in sensitive groups, replacing them with ephemeral runners scoped tightly to individual pipelines.
Increase monitoring of CI/CD job execution and runner registration events until all instances are confirmed upgraded.

bash

# Configuration example
# Verify the installed GitLab version on a self-managed instance
sudo gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5

# Upgrade an Omnibus installation to a patched release (Debian/Ubuntu)
sudo apt-get update
sudo apt-get install gitlab-ee=18.5.1-ee.0