CVE-2026-87719

Critical9.9Published on September 12, 2026

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

CVSS score9.9 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-502

Vulnerabilities

Critical GitLab File-Read Flaw Exploited Within a Day of Patch Disclosure

Unauthenticated GitLab flaw CVE-2026-85706 (CVSS 10) exploited within a day. Learn affected versions, detection logs and patch deadline.

Sep 12, 202605:165 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Critical GitLab File-Read Flaw Exploited Within a Day of Patch Disclosure