GitLab Pipeline Execution Policy variables not overwritten when template included
GitLab reported a vulnerability (CVE-2024-8311) where CI/CD variables set in project settings were not properly overwritten by pipeline execution policy variables when the policy included a template, potentially allowing security controls to be bypassed.
What happened
CI/CD variables from group or project settings were not properly overwritten by pipeline execution policies when a template was included in the policy configuration.
A project variable set in Settings → CI/CD → Variables would remain active even when a pipeline execution policy was configured to override it with a different value, if the policy included a GitLab template file.
Reported impact
Security controls intended to be enforced through pipeline execution policies could be bypassed by setting conflicting variables in project settings, potentially allowing unauthorized execution of security analysis tools such as SAST analyzers.
Index analysis
The vulnerability stemmed from improper handling of variable precedence when templates were included in pipeline execution policies, allowing lower-level project variables to take precedence over policy-level overrides.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.