CVE-2026-87719

critical · 9.9

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

9.9

CVSS

0.6%

EPSS (exploit prob.)

47th

EPSS percentile

2026-09-12

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-502

Affected products

Vendor	Product	Affected versions
gitlab	gitlab	>= 18.3.0, < 18.11.12
gitlab	gitlab	>= 19.0.0, < 19.0.9
gitlab	gitlab	>= 19.1.0, < 19.1.8
gitlab	gitlab	>= 19.2.0, < 19.2.6
gitlab	gitlab	>= 19.3.0, < 19.3.2

Check a specific version with /api/v1/cve/match.

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/628160
https://hackerone.com/reports/4012289

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-87719