BREAKING INTO GITLAB: ATTACKING AND DEFENDING SELF-HOSTED CI/CD ENVIRONMENTS

Summary from the TLDR InfoSec newsletter

Attackers can abuse globally scoped GitLab instance runners to execute arbitrary code and pivot into cloud environments if runners are configured with shell executors and attached IAM roles. Once a runner is compromised, the attackers can scrape build artifacts and environment files to steal secrets, SSH keys, or cloud credentials. Strategic defense centers on eliminating global runners, enforcing containerized job isolation, tightening IAM role scoping, and restricting access to the GitLab instance to reduce blast radius.