CVE-2026-87719
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
GitLab EE contains a vulnerability that allows an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials. The attacker uses a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.
Risk Assessment
An authenticated user could access sensitive instance configurations and credentials, potentially leading to privilege escalation and further compromise. However, it requires Duo Chat access.
Recommendation
Update GitLab EE to version 18.11.12, 19.0.9, 19.1.8, 19.2.6, or 19.3.2 (or later) for your respective branch. Consider restricting Duo Chat access and auditing user permissions.
Other vulnerabilities in GitLab
See all- CVE-2026-0723High
GitLab CE/EE versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an individual with knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.
- CVE-2025-13928High
GitLab CE/EE versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an unauthenticated user to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints.
- CVE-2025-13927High
GitLab CE/EE versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an unauthenticated user to create a denial of service condition by sending crafted requests with malformed authentication data.
- CVE-2025-11224High
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to execute stored cross-site scripting through improper input validation in the Kubernetes proxy functionality.
- CVE-2016-9469High
Multiple versions of GitLab expose a dangerous method that could lead to the deletion of all Issue and MergeRequest objects by any authenticated user. For publicly available projects, this vulnerability could be exploited by unauthenticated users.
- CVE-2016-4340High
The impersonate feature in Gitlab versions 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to 'log in' as any other user via unspecified vectors.
- CVE-2026-110264Critical
GitLab CE/EE across many versions contains an integer overflow when compiling a specially crafted regular expression. Under certain conditions this could allow an unauthenticated user to execute arbitrary code on the GitLab server.
- CVE-2026-97229CriticalActively exploited
GitLab CE/EE versions from 19.2 to 19.2.8, 19.3 to 19.3.5, and 19.4 to 19.4.2 contain a vulnerability that, under certain conditions, could allow an unauthenticated user to execute arbitrary code on the GitLab server. The issue stems from insufficient validation of regular expressions in CI/CD configuration.
- CVE-2026-85706CriticalActively exploited
GitLab CE/EE contains a vulnerability in the repository commits API caused by improper path confinement and missing authentication enforcement. Under certain conditions, an unauthenticated user could read arbitrary files from the GitLab server.
- CVE-2026-19478Critical
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
Original NVD description (English source)
GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS