CVE-2018-20500
Description
An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leaves the group and they know the token.
Summary dbcve.org
GitLab versions 9.4 through 11.6.0 lacked the ability to reset the CI/CD runner registration token. When maintainers left a group but retained knowledge of the token, they could register unauthorized runners to execute CI/CD pipelines, potentially leading to code execution, secrets theft, or pipeline tampering.
Mitigation
Upgrade GitLab to version 11.4.13, 11.5.6, 11.6.1 or later, which adds the token reset functionality in CI/CD settings. After upgrading, reset any runner registration tokens that may have been exposed.