GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Jobs

GitLab released fixes for several security flaws, including a critical pipeline privilege vulnerability (CVE-2024-6385, CVSS 9.6) that can allow attackers to run pipeline jobs as arbitrary users; earlier similar bugs (CVE-2024-5655) and a medium-severity namespace URL modification issue (CVE-2024-5257) were also patched. The article also notes critical and medium-severity patches from Citrix and Broadcom for other products, and highlights a CISA/FBI bulletin urging vendors to eliminate OS command injection flaws and adopt stronger access controls and zero-trust-like architectures.