CVE-2026-87719 in GitLab
Summary
by MITRE • 09/12/2026
GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
GitLab Enterprise Edition versions ranging from 18.3 up to but not including 19.1.8, as well as subsequent releases in the 19.2 and 19.3 series prior to their respective patch levels of 19.2.6 and 19.3.2, contain a critical security flaw within its GraphQL API implementation. This vulnerability specifically impacts users who have been granted access to Duo Chat functionality. The core issue stems from an improper validation mechanism in the serialization layer when processing subscription arguments for Advanced Search operations. An attacker with valid authentication credentials can exploit this weakness by crafting specific GraphQL queries that manipulate how object references are resolved on the server side.
The technical nature of this flaw involves a bypass of standard serialization protocols, allowing for unauthorized server-side object lookups. Normally, API endpoints restrict access to internal configurations and sensitive data based on user roles and permissions. However, in this scenario, the malformed subscription argument tricks the backend into exposing Advanced Search instance configurations that are typically hidden from end-users. More critically, this mechanism can be leveraged to retrieve sensitive credentials stored within the GitLab environment. This represents a significant breach of confidentiality as it allows an authenticated actor to access infrastructure-level details and authentication secrets without proper authorization checks being enforced during the deserialization process.
From an operational perspective, the impact of this vulnerability is severe for organizations relying on GitLab for their development workflows. The exposure of Advanced Search configurations could reveal internal architecture details or indexing strategies that might aid further reconnaissance efforts by malicious actors. More dangerously, the potential exfiltration of sensitive credentials compromises the integrity and security posture of the entire instance. These credentials may include API tokens, database passwords, or other secrets used for integrations with third-party services. If these values are compromised, an attacker could gain unauthorized access to external systems, escalate privileges within GitLab, or perform actions on behalf of affected users, leading to potential data loss, service disruption, or further lateral movement within the network.
This vulnerability aligns closely with CWE-209, which describes the generation of error messages containing sensitive information that can aid attackers in gaining unauthorized access, although it also strongly correlates with CWE-749 and CWE-755 regarding improper check for unusual or exceptional conditions during object lookup and serialization flaws respectively. In terms of attack vectors, this falls under MITRE ATT&CK technique T1059 Command and Scripting Interpreter via API abuse, specifically leveraging GraphQL to execute unauthorized queries that bypass intended access controls. It also relates to T1530 Data from Cloud Storage Object Discovery if the exposed configurations lead to further data retrieval actions.
To mitigate this risk, organizations running affected versions of GitLab EE must immediately upgrade to version 19.1.8 or later for the 19.1 branch, 19.2.6 or later for the 19.2 branch, and 19.3.2 or later for the 19.3 branch. These releases contain patches that enforce stricter validation on GraphQL subscription arguments and correct the serialization logic to prevent unauthorized object lookups. Until upgrades are applied, administrators should review access logs for unusual GraphQL activity related to Advanced Search subscriptions and consider restricting Duo Chat permissions to only those users who absolutely require them. Additionally, rotating any credentials that may have been exposed during the window of vulnerability is essential to maintain security integrity.