GitLab EE Advanced Search Leak via GraphQL sub (v18.3-<19.1.8,19.2-<19.2.6,19.3-<19.3.2)
CVE-2026-87719 Published on September 12, 2026
Deserialization of Untrusted Data in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.
Vulnerability Analysis
CVE-2026-87719 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is a Marshaling, Unmarshaling Vulnerability?
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVE-2026-87719 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.
Products Associated with CVE-2026-87719
Want to know whenever a new CVE is published for GitLab? stack.watch will email you.
Affected Versions
GitLab:- Version 18.3 and below 19.1.8 is affected.
- Version 19.2 and below 19.2.6 is affected.
- Version 19.3 and below 19.3.2 is affected.