# GitLab Duo Agent Platform: injected instructions ran commands as other users

> GitLab patched a Duo Agent Platform flaw that let one authenticated user inject agent instructions and act as another user.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** GitLab
- **Disclosed:** 2026-10-12
- **CVE:** CVE-2026-96893
- **CVSS:** 7.3
- **Affects:** GitLab Duo Agent Platform, GitLab Enterprise Edition
- **Research by:** Mert Coskuner, Rahul Barnwal
- **Primary source:** https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
- **Page:** https://theinjection.dev/items/gitlab-duo-agent-platform-instruction-injection/

GitLab Duo Agent Platform let an authenticated user inject content into AI agent instructions and run commands attributed to other users, fixed on October 12 in Enterprise Edition 19.2.8, 19.3.5 and 19.4.2.

## What happened

GitLab fixed two Duo Agent Platform security issues in its patch release of October 12, 2026, which shipped versions 19.2.8, 19.3.5 and 19.4.2. GitLab team members Mert Coskuner and Rahul Barnwal found them internally. Both CVE records were published the next day.

## How it works

Prompt injection is the mechanism: GitLab built its AI conversation context without neutralizing special elements, so content supplied by one authenticated user became part of the instructions the agent followed. Commands the agent then ran were attributed to other users. The second issue is a governance control bypass, where a single granular permission was enough to obtain a Duo Agent Platform token that skipped those controls.

## Who is affected

Enterprise Edition instances running the Duo Agent Platform are exposed, from version 19.1 up to each of the three patched releases. GitLab marks both CVEs as Enterprise Edition only, so the upgrade work falls on self-managed administrators. The affected ranges and scores are listed below.

## What to do

Upgrade self-managed GitLab Enterprise Edition to 19.2.8, 19.3.5 or 19.4.2, whichever matches your release line. Review which users hold the granular permissions that can mint Duo Agent Platform tokens.

## Quick facts

- **Affected:** GitLab Enterprise Edition 19.1 to 19.4.1, Duo Agent Platform
- **Fixed in:** 19.2.8, 19.3.5 and 19.4.2
- **CVE:** CVE-2026-96893 (CVSS 7.3), CVE-2026-105458 (CVSS 4.3)
- **Found by:** Mert Coskuner and Rahul Barnwal, GitLab team members
- **Disclosed:** October 12, 2026, in the 19.4.2 patch release
- **Attack type:** Prompt injection into AI agent instructions
- **Status:** Patched. Self-managed instances must upgrade.

## Questions

### Which GitLab versions fix CVE-2026-96893?

GitLab 19.2.8, 19.3.5 and 19.4.2 fix CVE-2026-96893, all published in the October 12, 2026 patch release. The flaw affects GitLab Enterprise Edition from version 19.1 until each of those releases, so an instance on 19.1 through 19.4.1 is exposed. GitLab scores the issue 7.3 and credits its own team member Mert Coskuner with finding it.

### Is GitLab Duo Agent Platform affected by more than one flaw in this release?

Two Duo Agent Platform issues shipped in the October 12 patch release. CVE-2026-96893, scored 7.3, is the instruction injection that can run commands attributed to another user. CVE-2026-105458, scored 4.3, let a user holding one granular permission obtain a Duo Agent Platform token that bypassed governance controls. Both affect Enterprise Edition from 19.1 and both are fixed in the same three versions.

### How is CVE-2026-96893 different from the GitLab AI Gateway flaw CVE-2026-90970?

CVE-2026-90970 affected the self-hosted GitLab AI Gateway and was disclosed on October 2, 2026. CVE-2026-96893 is a separate Duo Agent Platform flaw, fixed in the October 12 patch release, where content entering the AI conversation context is not neutralized before it reaches agent instructions. The two sit in different components and different releases, so applying the earlier fix does not cover this one.

## Sources

1. [GitLab Patch Release](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)
2. [GHSA CVE-2026-96893](https://github.com/advisories/GHSA-5vgp-j37h-7wfx)
3. [GHSA CVE-2026-105458](https://github.com/advisories/GHSA-v9q6-j9c6-x45f)