GitLab's Claude Agent Read Config From a User-Controlled Source, Giving Developers Arbitrary CI Commands (CVE-2026-18252)

NVD·high signalXBlueskyLinkedInCopy link

GitLab patched CVE-2026-18252 (CVSS 7.3, published to NVD 2026-08-26) in EE 19.3.1, 19.2.5 and 19.1.7, covering all versions from 18.9. An authenticated user with only Developer-role permissions could get the Claude agent to process configuration from a source they control and execute arbitrary commands inside the CI context. The blast radius is whatever the runner holds: source, package registries, deploy credentials, cloud tokens. This is the config-file-as-injection-surface problem that CLAUDE.md-style agent config files create, hit in a hosted CI product rather than on a laptop.