CVE-2026-105458 GitLab CVE debrief

Who should care

Defenders responsible for GitLab EE deployments should assess exposure and apply patches to remediate the issue, considering the specific granular permission required to obtain a GitLab Duo Agent Platform token that bypasses governance controls. They should also review compensating controls and monitor for potential unauthorized access.

Why it matters

Defenders should prioritize verifying exposure in GitLab EE deployments and applying patches to remediate the issue, as an authenticated user holding a specific granular permission could have obtained a GitLab Duo Agent Platform token that bypasses governance controls.

• Verify exposure in GitLab EE deployments
• Apply patches to remediate the issue
• Monitor for potential unauthorized access to GitLab Duo Agent Platform tokens

Technical summary

The issue in GitLab EE could have allowed an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypasses governance controls, due to reliance on untrusted input in a security decision. This vulnerability affects GitLab EE versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Defenders should prioritize verifying exposure in GitLab EE deployments and applying patches to remediate the issue, considering the potential impact on security posture.

Defensive priority

Defenders should prioritize verifying exposure in GitLab EE deployments and applying patches to remediate the issue.

Recommended defensive actions

• Verify exposure in GitLab EE deployments
• Apply patches to remediate the issue
• Monitor for potential unauthorized access to GitLab Duo Agent Platform tokens
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the affected GitLab EE versions and the remediation patches. Defenders should verify exposure in GitLab EE deployments and apply patches to remediate the issue, considering the specific granular permission required to obtain a GitLab Duo Agent Platform token. Evidence limits suggest that further verification may be necessary to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.