GitLab EE: developer-role user can run arbitrary commands in CI via attacker-controlled agent config

Impact

An account with only Developer permissions can get arbitrary commands executed in a CI context, because the Claude agent integration consumes configuration from a source the user controls. CI runners on a GPU fleet are rarely low-value targets: they commonly execute on or beside the accelerator nodes with the container toolkit mounted, and they hold registry push credentials and cluster tokens used to promote images into the serving path. The record notes the attack requires user interaction, so this is not a fully unattended path. GitLab reports confidentiality and integrity impact, not availability.

Who can reach it

An authenticated GitLab user holding Developer role on the target project, on an instance where the Claude agent CI integration is in use. Requires the user interaction the vendor records in the vector (UI:R).

What to do

Upgrade self-managed GitLab EE to 19.1.7, 19.2.5, or 19.3.1 (or later) per the patch release notes; all versions from 18.9 up to those are affected. This is a GitLab application upgrade and service restart, with no impact on runner nodes or GPU hosts. GitLab.com is already patched. If you cannot upgrade promptly, the described precondition is the agent integration itself, so disabling it removes the exposure.

References

Related entries

• Apache Airflow 3.3.0: Dag author reaches arbitrary imports in the scheduler via next_kwargs deserializationCVE-2026-67260 · Apache Airflow scheduler (awaiting_input sweep, next_kwargs deserialization)High
• Jenkins: session is not rotated on remember-me login, allowing session fixation against any userCVE-2026-84652 · Jenkins core (remember-me authentication, session handling)High
• Renovate gomod manager: shell metacharacters in a dependency name run commands as the Renovate userCVE-2026-88885 · Renovate (gomod manager, import-path update with binarySource=docker)High
• Renovate Mix manager: unescaped organization parameter lets a package name run commands as the Renovate userCVE-2026-88888 · Renovate (Mix manager, private dependency organization parameter)High
• GitLab EE: injected AI conversation context causes agent commands to run as another userCVE-2026-96893 · GitLab EE (AI agent conversation context construction)High
• HPE iLO4 / iLO5: Remote code execution on the management controllerCVE-2018-7078 · HPE iLO4 / iLO5High