CVE-2026-18252

Published: Aug 26, 2026Modified: Aug 31, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source.

Affected (3)

Products: Gitlab: Gitlab

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 18.9.0 to 19.1.7
Gitlab Gitlab	From 19.2.0 to 19.2.5
Gitlab Gitlab	Version 19.3.0

Related CWEs

Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

References (3)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/

Source: cve@gitlab.com

Release NotesVendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/work_items/607342

Source: cve@gitlab.com

Issue Tracking

https://hackerone.com/reports/3863650

Source: cve@gitlab.com

Permissions RequiredThird Party Advisory

Timeline

No history available yet.