CVE-2026-92529: GitLab EE AI Governance Bypass Vulnerability

CVE-2026-92529 Overview

CVE-2026-92529 is an authorization bypass vulnerability in GitLab Enterprise Edition (EE) affecting the platform's AI tool governance controls. An authenticated user holding developer-role permissions can bypass admin-configured governance restrictions on AI workflows in namespaces the user does not control. The root cause is an improper authorization check [CWE-863] in the AI workflow enforcement path.

The issue affects GitLab EE versions 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. GitLab has released patches in all three release branches.

Critical Impact
Authenticated developers can execute AI workflows outside admin-defined governance boundaries, undermining organizational controls on generative AI usage inside GitLab.

Affected Products

GitLab Enterprise Edition (EE) 19.1 through versions before 19.2.7
GitLab Enterprise Edition (EE) 19.3 through versions before 19.3.3
GitLab Enterprise Edition (EE) 19.4 through versions before 19.4.1

Discovery Timeline

2026-09-24 - CVE-2026-92529 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database
Patch release - Documented in GitLab Patch Release 19.4.1

Technical Details for CVE-2026-92529

Vulnerability Analysis

CVE-2026-92529 is an authorization flaw in GitLab EE's AI workflow governance layer. GitLab administrators can configure controls over which AI tools and workflows are permitted within specific namespaces. The affected releases fail to consistently enforce those controls when a workflow executes in a namespace the authenticated user does not own or administer.

A user with developer-role permissions can invoke AI workflows that should be blocked by administrator policy. This weakens the guardrails organizations rely on to restrict generative AI usage, control data exposure through AI tooling, and satisfy internal compliance requirements. The vulnerability requires an authenticated session and does not require administrator credentials or user interaction.

The technical fix is tracked in GitLab Work Item #605431.

Root Cause

The defect is classified as Improper Authorization [CWE-863]. The AI workflow governance code path validates that the caller is authenticated and holds a developer role, but it does not correctly verify that the target namespace's governance policy permits the requested workflow. As a result, policy checks configured by administrators are not enforced across cross-namespace workflow invocations.

Attack Vector

The attack requires network access to the GitLab EE instance and an authenticated account with at least developer-role permissions. No user interaction is required and confidentiality is not directly impacted. The attacker crafts a request that triggers an AI workflow tied to a namespace they do not administer. The governance policy that should reject the request is not applied, allowing the workflow to execute. See GitLab Patch Release 19.4.1 for the vendor's remediation notice.

Detection Methods for CVE-2026-92529

Indicators of Compromise

AI workflow executions initiated by developer-role accounts targeting namespaces where those users are not members or maintainers.
Audit log entries showing AI tool invocations that contradict the namespace's configured AI governance policy.
Repeated workflow triggers from a single developer account against multiple namespaces they do not own.

Detection Strategies

Correlate GitLab audit events for AI workflow execution against namespace membership data to flag out-of-scope invocations.
Establish a baseline of AI workflow usage per user and namespace, and alert on deviations that cross namespace boundaries.
Review GitLab application logs for AI governance policy evaluations that permit actions inconsistent with configured policy.

Monitoring Recommendations

Enable GitLab administrative and audit logging for AI features and forward the events to a centralized SIEM.
Monitor changes to AI governance policies and role assignments across namespaces for unexpected modifications.
Track authentication and role-assignment events on developer accounts that suddenly interact with new namespaces.

How to Mitigate CVE-2026-92529

Immediate Actions Required

Upgrade GitLab EE to 19.2.7, 19.3.3, or 19.4.1 as applicable to your release branch.
Inventory namespaces with AI governance policies and audit recent workflow executions for policy-violating activity.
Review developer-role assignments and remove unnecessary access to reduce the population of accounts able to reach the vulnerable code path.

Patch Information

GitLab remediated the issue in versions 19.2.7, 19.3.3, and 19.4.1. Administrators running self-managed GitLab EE should schedule an upgrade to a fixed release. Full remediation details are published in the GitLab Patch Release 19.4.1 announcement and the underlying fix is tracked in GitLab Work Item #605431.

Workarounds

If immediate patching is not possible, temporarily disable AI workflow features in affected namespaces until the upgrade is applied.
Restrict developer-role membership on namespaces that host sensitive AI governance policies.
Tighten role assignments so that only trusted users can trigger AI workflows across shared namespaces.

bash

# Verify installed GitLab version on a self-managed instance
sudo gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5

# Upgrade example on Debian/Ubuntu package-based installs
sudo apt-get update && sudo apt-get install gitlab-ee=19.4.1-ee.0