CVE-2024-11222

CVE-2024-11222 is a time-of-check/time-of-use race condition (CWE-367) in GitLab's pipeline creation logic, affecting GitLab Community and Enterprise Edition. A developer-level user triggers the flaw by initiating a pipeline under conditions that race with merge request processing, causing their actions to execute in the context of another user's merge request commit. The attacker gains the ability to perform actions attributed to another user's commit, with high confidentiality and integrity impact, though no privilege escalation beyond developer access or availability impact is implied. All GitLab CE/EE deployments running versions from 13.0 prior to 19.1.8, 19.2.x prior to 19.2.6, or 19.3.x prior to 19.3.2 are affected. GitLab has remediated the issue; exploitation requires an authenticated developer account, and there is no evidence of in-the-wild exploitation or a known public proof of concept.

What to do: Upgrade GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 (or later) depending on your release track. Because exploitation requires developer access, review pipeline-creation logs for pipelines unexpectedly attributed to other users' merge request commits and restrict pipeline triggers on sensitive projects to trusted developers. No public exploit is known, so patching before this flaw is weaponized is the priority.