by Kastro
Paper/Archive/CVE-2026-87719

CVE-2026-87719

GitLab GitLab — Deserialization of Untrusted Data in GitLab

EPSS 0.6%CVSS 9.9
critical.is priorityof 100
39
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 47.2.472 × 209.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

Affected

ProductAffectedFixed inSource
GitLab18.3 – < 18.11.1218.11.12CNA
GitLab19.0 – < 19.0.919.0.9CNA
GitLab19.1 – < 19.1.819.1.8CNA
GitLab19.2 – < 19.2.619.2.6CNA
GitLab19.3 – < 19.3.219.3.2CNA

Scores by source

GitLab (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgitlab.com/gitlab-org/gitlab/-/work_items/628160exploithackerone.com/reports/4012289