Group Runner Registration Token Vulnerability
Apr 10, 2019Kathy Wang
Summary
This post details a security vulnerability where Group Runner Registration Tokens were exposed. A patch was deployed to GitLab.com, and Group Runner Registration Tokens were reset. Critical security releases (EE 11.9.7, 11.8.7, 11.7.11) were issued for self-managed instances. No evidence of unauthorized project access was found. Self-managed Community Edition instances are unaffected.
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting