CVE-2024-2743 is an authorization flaw in GitLab EE that lets an attacker modify an on-demand DAST scan without permissions and leak variables, scored Medium at 5.3, fixed in 17.1.7, 17.2.5 and 17.3.2. Severity is Medium at 5.3. Upgrade to GitLab 17.1.7, 17.2.5 or 17.3.2 or later.
What's affected
- GitLab EE starting with version 13.3 before 17.1.7.
- GitLab EE 17.2 before 17.2.5.
- GitLab EE 17.3 before 17.3.2.
- GitLab's release post says GitLab.com already runs the patched version and GitLab Dedicated customers do not need to act. Self managed installations need to upgrade.
- GitLab titles the issue as exposure of protected and masked CI/CD variables by abusing on-demand DAST. It rates it Medium at 5.3, matching the NVD record.
The NVD record gives a CVSS score of 5.3 with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. Published 2024-09-12.
How to check if you're exposed
- In GitLab, open Help, or visit the /help page, to see the version.
- As an administrator, the Admin Area overview shows the version, and
sudo gitlab-rake gitlab:env:infoprints it on a self managed host. - Compare your version with the three fixed versions above, using the one for your release line.
- Check whether your projects use on-demand DAST scans at all.
What to do now
- Upgrade to the patch release for your line: 17.1.7, 17.2.5 or 17.3.2, or newer.
- If you cannot upgrade immediately, review who has rights to run and edit on-demand DAST scans.
- Review audit events for unexpected changes to DAST scan configuration.
- Consider rotating CI/CD variables that the DAST jobs can see, if you cannot rule out misuse.
- Keep up with GitLab patch releases, which GitLab says it ships regularly.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
The weakness is incorrect authorization: an action that should be limited by permissions can be done by someone without them. Here, changing an on-demand DAST scan could expose variables, including protected and masked CI/CD variables, per GitLab's title. Variables in pipelines often hold tokens and keys, which is why a medium score still deserves a prompt upgrade.
The score is held down by high attack complexity and the need for some privileges, per the vector. It reflects confidentiality impact only, with no integrity or availability effect.
The record tags the weakness as CWE-863. See the Gold pages for more on the class.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
Pipeline secrets are one of the most valuable things in a source platform. Treat variable exposure issues as more serious than their scores.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Are GitLab.com users affected?
GitLab says GitLab.com is already running the patched version. Self managed installs need to upgrade.
What should I rotate?
If you cannot rule out misuse, rotate secrets stored as CI/CD variables that the affected scans could see.
Sources
Last reviewed: 19 October 2026.
