CVE-2026-87719

CRITICALCVSS 9.9

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

Timeline

Published:September 12th, 2026 3:16 AM

Last modified:September 16th, 2026 7:23 PM

CVSS Scoring

CVSS v3: 9.9 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-502

References & Reports

Advisories, patches, and third-party reports

https://gitlab.com/gitlab-org/gitlab/-/work_items/628160
https://hackerone.com/reports/4012289

Source: NIST NVD · Data may lag official sources by up to one minute