CVE-2024-9164

—

CVSS 3.1

8.8 high

EPSS

1%p62

Published

Oct 11, 2024 (Oct 11, 2024)

Modified

Jun 17, 2026

Description

An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.

Vendors: gitlab
Products: gitlab
Weakness: CWE-306
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news3 stories

THN Cybersecurity Recap: Top Threats, Tools and News (Oct 14

The Hacker NewsOct 21, 12:11 UTC · Oct 21, 2024Data breach in the wildCVE-2024-38178 CVE-2024-9486 CVE-2024-44133+7 CVEs

GitLab fixed a critical flaw that could allow arbitrary CI/CD pipeline execution

Security AffairsOct 11, 17:34 UTC · Oct 11, 2024Vulnerability CVE-2024-9164 CVE-2024-8970 CVE-2024-8977+5 CVEs

New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution

The Hacker NewsOct 11, 06:29 UTC · Oct 11, 2024Vulnerability in the wildCVE-2024-9164 CVE-2024-8970 CVE-2024-8977+6 CVEs