CVE-2026-105458: Reliance on Untrusted Inputs in a Security Decision in GitLab

Q: Which GitLab EE versions need remediation?

Affected releases are GitLab EE 19.1 through versions before 19.2.8, 19.3 through versions before 19.3.5, and 19.4 through versions before 19.4.2. Upgrade to 19.2.8, 19.3.5, 19.4.2, or a later release in the applicable release line.

Q: What level of access does an attacker need?

Exploitation requires an authenticated GitLab user with the specific granular permission referenced in the advisory. The issue is network-reachable and requires no user interaction, but it is not exploitable by an unauthenticated user according to the provided vector.

Q: What is the potential impact?

Under certain conditions, the affected user could obtain a GitLab Duo Agent Platform token that bypasses governance controls. The stated impact is integrity-related; no confidentiality or availability impact is identified.

Published Oct 13, 2026

Updated

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypasses governance controls, due to reliance on untrusted input in a security decision.

Affected Software

1 affected component

GitLab GitLab EE>=19.1<19.2.8, >=19.3<19.3.5, >=19.4<19.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GitLab EE to a version that resolves this vulnerability.
Fixed in 19.2.8
Upgrade
Upgrade GitLab EE to a version that resolves this vulnerability.
Fixed in 19.3.5
Upgrade
Upgrade GitLab EE to a version that resolves this vulnerability.
Fixed in 19.4.2

Event History

Oct 13, 2026

CVE Published

via MITRE·01:04 AM

Data Sourced

via MITRE·01:04 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which GitLab EE versions need remediation?

Affected releases are GitLab EE 19.1 through versions before 19.2.8, 19.3 through versions before 19.3.5, and 19.4 through versions before 19.4.2. Upgrade to 19.2.8, 19.3.5, 19.4.2, or a later release in the applicable release line.

What level of access does an attacker need?

Exploitation requires an authenticated GitLab user with the specific granular permission referenced in the advisory. The issue is network-reachable and requires no user interaction, but it is not exploitable by an unauthenticated user according to the provided vector.

What is the potential impact?

Under certain conditions, the affected user could obtain a GitLab Duo Agent Platform token that bypasses governance controls. The stated impact is integrity-related; no confidentiality or availability impact is identified.

CVE-2026-105458: Reliance on Untrusted Inputs in a Security Decision in GitLab

Affected Software

Remediation

Event History

Frequently Asked Questions

Which GitLab EE versions need remediation?

What level of access does an attacker need?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which GitLab EE versions need remediation?

What level of access does an attacker need?

What is the potential impact?