CVE-2026-87719 GitLab CVE debrief

Who should care

Defenders responsible for GitLab EE instances, particularly those with Duo Chat access enabled, should assess exposure and prioritize remediation to prevent potential credential exposure and unauthorized access to sensitive configurations. This includes reviewing instance configurations, monitoring for suspicious activity, and ensuring that vulnerable versions are remediated.

Why it matters

Defenders should prioritize verifying exposure and remediating vulnerable GitLab EE versions to prevent potential credential exposure and unauthorized access to sensitive configurations.

• Potential credential exposure for authenticated users with Duo Chat access.
• Possible unauthorized access to Advanced Search instance configurations.

Technical summary

The vulnerability affects GitLab EE versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. An authenticated user with Duo Chat access can exploit the issue using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup, potentially leading to obtaining Advanced Search instance configurations and sensitive credentials. Defenders should prioritize verifying exposure and remediating vulnerable versions of GitLab EE, particularly those with Duo Chat access enabled.

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable versions of GitLab EE, particularly those with Duo Chat access enabled.

Recommended defensive actions

• Verify exposure by checking if your GitLab EE instance has Duo Chat access enabled and is running a vulnerable version.
• Remediate vulnerable versions of GitLab EE to prevent potential credential exposure.
• Monitor for suspicious GraphQL subscription activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including affected versions and a CVSS score of 9.9. GitLab has remediated the issue in various versions. The vulnerability affects GitLab EE versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. An authenticated user with Duo Chat access can exploit the issue using a specially crafted GraphQL subscription argument. The issue allows obtaining Advanced Search instance configurations and sensitive The CVE

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.