CRITICAL 9.9 NVD

CVE-2026-87719

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain condit

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

References

Published: 2026-09-12 · Source: NVD · Feed updated: 2026-09-12

This critical severity vulnerability with a CVSS score of 9.9 was published on 2026-09-12 via NVD.

Risk Timeline

CVE Disclosed2026-09-12 · -1 days ago

Remediation Resources

Analysis & PoC

gitlab.com/gitlab-org/gitlab/-/work_items/628160

Analysis & PoC

hackerone.com/reports/4012289

vulnfeed aggregates 13077 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.