CVE-2025-2246: 
GitLab vulnerability analysis and mitigation

A security vulnerability identified as CVE-2025-2246 was discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1. The vulnerability was disclosed on August 27, 2025, and allows unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL API (GitLab Release, NVD).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 base score of 5.8 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. The vulnerability specifically affects the GraphQL API endpoint, allowing unauthorized access to sensitive CI/CD variables (NVD).

The vulnerability enables unauthenticated users to access sensitive manual CI/CD variables through the GraphQL API, potentially exposing confidential configuration data and secrets (GitLab Release).

GitLab has released patches in versions 18.1.5, 18.2.5, and 18.3.1 to address this vulnerability. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com has already been updated with the security fix, and GitLab Dedicated customers do not need to take any action (GitLab Release).