GITLAB SENDS USERS SCRAMBLING AGAIN WITH NEW CI/CD PIPELINE TAKEOVER VULN

Summary from the TLDR InfoSec newsletter

GitLab has disclosed a critical vulnerability (CVE-2024-6385) that affects its DevOps platform's CI/CD pipelines. The flaw, rated 9.6 out of 10 in severity, allows attackers to run pipelines as any user, potentially accessing sensitive data and injecting malicious code. GitLab strongly urges users to upgrade immediately to the latest patched version.