Unauthorized Access to CI/CD Infrastructure and Project Secrets via Compromised GitLab Runner Token

Disclosed by

Engagement National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
Disclosed date 20 Aug 2026 2 days ago
Priority P1 Bugcrowd's VRT priority rating
Status Resolved This vulnerability has been accepted and fixed

Summary by oguzhan_00

A publicly exposed NASA GitLab Runner registration token allowed an external researcher to successfully register and authenticate an unauthorized runner within NASA’s SMCE CI/CD infrastructure. This demonstrated a real supply-chain security impact, as the compromised runner could potentially access CI/CD secrets and influence build processes, while further exploitation was intentionally avoided.
Best Regards,
oguzhan_00

Unauthorized Access to CI/CD Infrastructure and Project Secrets via Compromised GitLab Runner Token

Summary by oguzhan_00

Activity