CVE-2026-87719
GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| gitlab | gitlab | < 18.11.12 |
Related articles
GitLab Path Traversal Flaw Enters CISA KEV With Three-Day Patch Deadline
GitLab CVE-2026-85706 allows unauthenticated file access via API. CISA added it to KEV with Sept 14 deadline. Learn affected versions and fixes.
Critical GitLab File-Read Flaw Exploited Within a Day of Patch Disclosure
Unauthenticated GitLab flaw CVE-2026-85706 (CVSS 10) exploited within a day. Learn affected versions, detection logs and patch deadline.
This product uses the NVD API but is not endorsed or certified by the NVD.