Executive brief
GitLab's Duo Claude AI agent integration processes CI/CD pipeline configuration from user-supplied sources. An authenticated developer can inject malicious configuration that the AI agent processes, allowing arbitrary command execution within CI pipelines. This could enable attackers to steal secrets, modify code, deploy malicious changes, or pivot to downstream systems.
Technical details
The vulnerability is an "Inclusion of Functionality from Untrusted Control Sphere" flaw where the Claude AI agent processes CI/CD configuration originating from user-controlled sources without sufficient validation. An authenticated user with developer-role permissions can craft malicious pipeline configuration that the agent will execute, resulting in arbitrary command execution in the CI context. The attack requires network access and user authentication but not additional user interaction beyond normal CI workflow. An attacker gains the ability to execute arbitrary code with the privileges of the CI runner, potentially compromising build artifacts, secrets, and downstream deployments. Patches are available in GitLab EE versions 19.1.7, 19.2.5, and 19.3.1.
Affected products
- GitLab GitLab EE 18.9 before 19.1.7, 19.2 before 19.2.5, 19.3 before 19.3.1
Timeline
- 2026-08-26: disclosed: CVE-2026-18252 published
- 2026-08-26: patched: Fixes released in GitLab EE 19.1.7, 19.2.5, 19.3.1