Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-26T14:17:08.000Z",
  "pubdate": "2026-08-26T14:17:08.000Z",
  "executiveSummary": "This vulnerability involves an arbitrary command execution flaw within GitLab EE, specifically affecting the CI/CD pipeline environment. The vulnerability stems from the improper handling of configuration inputs by the Claude agent, allowing an authenticated user with Developer-level permissions to trigger unauthorized command execution.\nThe flaw exists in versions 18.9 through 19.1.6, 19.2.0 through 19.2.4, and 19.3.0. Impacted systems face severe security risks, as successful exploitation enables attackers to execute arbitrary commands within the context of the CI execution environment. This capability allows for unauthorized code execution, potential data exfiltration, and full pipeline compromise. The exploit requires authentication as a user with at least Developer-role permissions to influence the configuration source processed by the Claude agent. The reliance on user-controlled inputs for configuration processing makes this a high-severity entry point for attackers seeking to escalate privileges or gain persistent access within the CI/CD infrastructure.",
  "technicalDetails": "The root cause of this vulnerability is an input validation failure within the Claude agent component of GitLab EE. The agent is designed to process configuration files or parameters to automate CI/CD tasks; however, it fails to sanitize or validate configuration sources provided by authenticated users. Because the Claude agent interprets and executes directives derived from these user-controlled sources without sufficient isolation or verification, an attacker can inject malicious commands into the CI execution flow.\nAffected versions include GitLab EE 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. The vulnerability is triggered when a user with Developer-role permissions modifies or supplies a configuration file that the Claude agent subsequently parses. The attack flow begins with the attacker crafting a malicious CI configuration that embeds arbitrary shell commands or code payloads within fields interpreted by the agent. When the GitLab CI pipeline initiates, the Claude agent fetches this configuration.\nBecause the agent lacks strict enforcement of secure configuration schemas, it executes the embedded payload as part of the CI job initialization or processing logic. This execution occurs within the security context of the CI runner, granting the attacker the same permissions as the runner environment. Consequently, if the runner is configured with elevated environment variables, secrets, or API tokens, these are potentially accessible to the attacker post-exploitation.\nThe exploitation method relies on the trust relationship between the Claude agent and the configuration source. By manipulating the input source, an attacker bypasses intended security boundaries. The impact is significant: an attacker could pivot to other internal services, steal sensitive repository information, or inject malicious code into the application build process, leading to supply chain compromises. Since the vulnerability resides within the agent's logic for processing configuration, it bypasses standard static analysis security testing (SAST) if those tools are focused on source code rather than dynamic configuration parsing logic at runtime. The execution occurs server-side within the CI context, necessitating immediate patching of the GitLab EE instance to resolve the underlying logic flaw in the agent's input handling mechanism."
}