CVE-2026-105458
Received Received - Intake

GitLab Duo Agent Platform Token Bypass in GitLab EE

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitLab Inc.

Description
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypasses governance controls, due to reliance on untrusted input in a security decision.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-105458
EUVD
EUVD-2026-98207

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
GitLab GitLab 19.1
GitLab GitLab 19.3
GitLab GitLab 19.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GitLab EE had an issue where an authenticated user with a specific permission could obtain a GitLab Duo Agent Platform token that bypasses governance controls. This happened because the system relied on untrusted input when making security decisions.

Detection Guidance

This vulnerability requires checking GitLab versions and permissions. Verify if your GitLab instance is running versions 19.1 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2. Use commands like 'gitlab-rake gitlab:env:info' to check version details.

Impact Analysis

An attacker with the right permissions could bypass governance controls, potentially accessing or modifying data they shouldn't. This could lead to unauthorized actions or data exposure within GitLab.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements like GDPR or HIPAA. Bypassing governance controls undermines data protection and audit measures.

Mitigation Strategies

Upgrade GitLab EE to version 19.2.8, 19.3.5, or 19.4.2 or later to address the vulnerability. Ensure all instances are updated to prevent potential token bypass issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105458. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart