← Back

CVE-2026-105458

nvd nist
Published: Oct 13, 2026Modified: Oct 14, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitability: 2.8 / Impact: 1.4
Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypasses governance controls, due to reliance on untrusted input in a security decision.

Affected (3)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
19.1.0 ≤ version < 19.2.8
Gitlab
19.3.0 ≤ version < 19.3.5
Gitlab
19.4.0 ≤ version < 19.4.2

Related CWEs

CWE-807
Reliance on Untrusted Inputs in a Security Decision
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

References (2)

Source: cve@gitlab.com
Release NotesVendor Advisory
Source: cve@gitlab.com
Issue Tracking

Timeline

No history available yet.