GitLab Duo token issuance bypassed configured governance checks

An authenticated GitLab user holding a specific granular permission could, under the vendor's stated conditions, obtain a Duo Agent Platform token that bypassed governance controls. GitLab disclosed CVE-2026-105458 in its October 12 patch bulletin. The reported defect lies in a software security decision, rather than a model's willingness to follow a prompt.

GitLab attributes the issue to reliance on untrusted input when deciding whether to issue the token. The caller already needs authentication and the relevant permission, so the disclosure does not support a claim of anonymous token creation. Nor does it enumerate every operation the resulting token could perform. The durable finding is that configured governance failed to constrain the token through the intended decision path.

The affected EE ranges begin with 19.1 before 19.2.8, include 19.3 before 19.3.5, and include 19.4 before 19.4.2. GitLab identifies those corrected patch releases and credits internal researcher Rahul Barnwal. The vendor's correction does not establish that all deployed installations have received it, and the bulletin does not report a verified token-theft campaign.

This distinction changes the control question. Conversation screening addresses what an agent interprets, while token issuance must enforce governance independently of caller-controlled values. The other Duo flaw in the release concerns injected context and cross-user command attribution. Neither finding supplies the missing exploitation details of the other.