Masked variable vulnerability in Runner version 13.9.0-rc1

What this post added

This post details a security vulnerability in GitLab Runner version 13.9.0-rc1 where masked CI variables were exposed in build logs. It explains the conditions under which users were affected (GitLab.com shared runners between specific dates, or self-managed instances using the vulnerable runner version). It provides examples of commands that could lead to variable exposure and outlines remediation steps: reviewing jobs for printed variables, rotating secrets, and upgrading/downgrading GitLab Runner. GitLab's actions included deploying a fix (v13.9.0-rc2) and contacting affected users.