GitLab Patches High Runner Hijacking Flaw (CVE-2025-11702) and Multiple DoS Vulnerabilities

GitLab released updates for both Community Edition and Enterprise Edition—versions 18.5.1, 18.4.3, and 18.3.5—to fix multiple vulnerabilities, including a high-severity flaw that could let an authenticated user hijack project runners from other projects within the same instance (CVE-2025-11702, CVSS 8.5). The advisory also covers three DoS vulnerabilities affecting CE/EE that could be exploited by unauthenticated users, with CVEs 2025-10497 (CVSS 7.5), 2025-11447 (CVSS 7.5), and 2025-11974 (CVSS 6.5).

The flaws could allow attackers to disrupt service or, in the hijack scenario, gain control over build infrastructure and potentially intercept CI/CD secrets or inject malicious code into pipelines. Additional issues addressed include CVE-2025-11971 (CVSS 6.5) involving incorrect authorisation in pipeline builds, and CVE-2025-6601 (CVSS 3.8) related to group membership and access approvals in GitLab EE. According to GitLab, the fixes remediate an issue that could have enabled hijacking of runners and protect deployments that rely on shared runners.