CVE-2026-105458

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105458
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105458.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105458
Aliases
Downstream
MINI (3)
UBUNTU (1)
Published
2026-10-13T01:04:51Z
Modified
2026-10-30T10:47:16Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Reliance on Untrusted Inputs in a Security Decision in GitLab
Details

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypasses governance controls, due to reliance on untrusted input in a security decision.

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-807"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105458.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
67581074a0aab1f53cdafe7eead5f5d07f3afec8
Fixed
9a42f777a0147768457ebe684e13e69d54eee652
Introduced
8f83039bebbbb61d3b7b8b7e2342d1deec1e14c6
Fixed
ce7cbf1bcc4e49e98f209097d5081030e30410c5
Introduced
fa703f93afaf1133cd263f6aa0e91d284d7f1ebf
Fixed
9c053f678a4924425869b1b9e4bca3a44e45edf7
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.1.0"
                },
                {
                    "fixed": "19.2.8"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.3.0"
                },
                {
                    "fixed": "19.3.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.4.0"
                },
                {
                    "fixed": "19.4.2"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v19.*
v19.3.0-ee
v19.4.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105458.json"