Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-08-26

HighVendor post

GitLab Duo Claude CVE-2026-18252 Allowed Developer-Role Users to Execute Arbitrary CI Commands

CVE-2026-18252 root cause, affected GitLab versions, and fixed releases for the Duo Claude agent CI command-execution vulnerability.

GitLab Duo Claude AgentTool execution / MCPUntrusted agent-configuration processing leading to CI command executionGitLab Enterprise Edition CI/CD environments using the Duo Claude agent

What happened

An authenticated developer supplies configuration that the Duo Claude agent processes and, under affected conditions, causes arbitrary command execution in CI.

Why it matters

Arbitrary CI command execution can expose repository or job data and alter build outputs within the permissions and credentials available to the affected job.

Missing authorization check

Independent validation of agent-derived CI commands and explicit authorization before artifacts, deployments, credentials, or other consequential outputs leave the job.

Would PP block it?

Commands may still run in the affected CI context. Consequential downstream steps can require a receipt tied to the reviewed commit, artifact, environment, and action, preventing the compromised job from self-authorizing release or deployment.

Direct answer

Root cause, affected versions, and fix

Root cause
The GitLab Duo Claude agent processed configuration from a source controlled by an authenticated developer-role user. Under affected conditions, that configuration crossed into the CI command-execution context.
Affected versions
GitLab EE 18.9 through versions before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 are affected.
Fix
Upgrade to GitLab 19.1.7, 19.2.5, 19.3.1, or a later supported release. Continue isolating runners and minimizing job credentials because the patch does not replace downstream release authorization.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-08-26

    GitLab releases versions 19.3.1, 19.2.5, and 19.1.7 with a fix for CVE-2026-18252.

  2. 2026-08-26

    GitLab assigns CVSS 7.3 and credits the report through its HackerOne bug bounty program.

Technical breakdown

  • The vulnerable component is the Duo Claude AI agent in GitLab Enterprise Edition.
  • The agent processed configuration from a source controlled by an authenticated developer-role user.
  • Under affected conditions, that trust-boundary error enabled arbitrary command execution in a CI context.
  • GitLab lists EE 18.9 through pre-19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 as affected.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Deploy Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Artifact publication, deployment, credential-use, and protected data-mutation boundaries outside the CI job
Still needs
Upgrading GitLab, isolating runners, minimizing job credentials, and validating agent configuration remain necessary.
Receipt required for
Publishing artifacts, deploying releases, using protected credentials, or mutating production systems from the CI job

A Deploy Gate can stop unauthorized artifact publication or deployment after CI compromise, but it does not prevent command execution inside a vulnerable runner.

Start small

Put the relevant gate at this action boundary.

This incident maps to Deploy Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Install on one repo