GitLab has released security updates for both its Community Edition and Enterprise Edition, addressing seven vulnerabilities, including a high-severity flaw in its Duo Claude AI agent.
This vulnerability could allow authenticated developers to execute arbitrary commands within a CI (Continuous Integration) context.
The issue, tracked as CVE-2026-18252, arises from the inclusion of functionality from an untrusted control sphere. Under certain conditions, GitLab’s Claude agent processed configurations supplied from user-controlled sources.
An authenticated user with the Developer role could exploit this behavior to execute arbitrary commands within the CI environment.
The vulnerability has a CVSS score of 7.3. It affects GitLab Enterprise Edition deployments running from 18.9 through 19.1.7, 19.2.5, and 19.3.1. Although exploitation requires low privileges and user interaction, successful exploitation could compromise the confidentiality and integrity of resources accessible from the affected CI job.
The risk is especially significant for organizations where CI runners have access to source code, package registries, deployment credentials, cloud tokens, or production infrastructure.
Command execution within a pipeline could enable an attacker to exfiltrate CI variables, alter build artifacts, tamper with release workflows, or pivot into connected environments, depending on the runner’s configuration and token scope.
GitLab has credited HackerOne researcher thwin_htet for reporting CVE-2026-18252. GitLab.com is already using patched software, and GitLab Dedicated customers do not need to take any action.
Self-managed customers should upgrade immediately to either GitLab version 19.3.1, 19.2.5, or 19.1.7, depending on their supported release track.
The patch releases also address vulnerabilities related to denial-of-service, authorization, and pipeline-policy weaknesses. Notably, CVE-2026-15387 enables Developers to influence the execution environment of Pipeline Execution Policy enforcement jobs due to improper handling of job dependencies.
Although rated as medium severity, this issue deserves attention in environments that utilize centralized pipeline governance controls.
Administrators are advised to review CI/CD job logs for any unexpected commands, inspect recent changes to the Claude agent configuration and pipeline policy dependencies, rotate any exposed CI credentials if suspicious activity is identified, and ensure that runners operate with least-privilege permissions.
CVE Details
| CVE | Severity / CVSS | Affected editions and versions | Security impact |
|---|---|---|---|
| CVE-2026-18252 | High / 7.3 | EE 18.9 to before 19.1.7; 19.2 to before 19.2.5; 19.3 to before 19.3.1 | Developer can execute arbitrary CI-context commands through Claude agent processing of user-controlled configuration |
| CVE-2026-77801 | Medium / 6.5 | CE/EE 12.8 to before 19.1.7; 19.2 to before 19.2.5; 19.3 to before 19.3.1 | Authenticated user can disrupt background-job processing through missing object-count limits in import pipelines |
| CVE-2025-10903 | Medium / 6.5 | EE 11.10 to before 19.1.7; 19.2 to before 19.2.5; 19.3 to before 19.3.1 | Specially crafted SCIM provisioning input triggers an unbounded loop and denial of service |
| CVE-2026-3035 | Medium / 5.5 | EE 11.3 to before 19.1.7; 19.2 to before 19.2.5; 19.3 to before 19.3.1 | Project Maintainer may access a protected-environment terminal without authorization |
| CVE-2026-4398 | Medium / 5.4 | EE 18.3 to before 19.1.7; 19.2 to before 19.2.5; 19.3 to before 19.3.1 | User may assign inaccessible namespace compliance frameworks to their own project on self-managed instances |
| CVE-2026-15387 | Medium / 4.3 | EE 19.1 to before 19.1.7; 19.2 to before 19.2.5; 19.3 to before 19.3.1 | Developer can influence Pipeline Execution Policy enforcement-job environments via job dependencies |
| CVE-2026-7487 | Low / 3.5 | EE 13.1 to before 19.1.7; 19.2 to before 19.2.5; 19.3 to before 19.3.1 | Merge-request author with Reporter access can reset approval rules |
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…