CVE-2026-87719: Deserialization of Untrusted Data in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.1.8 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.6 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.2
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have access to Duo Chat. Exploitation also requires sending a specially crafted GraphQL subscription argument under the affected conditions.
What information could be exposed?
The issue could allow retrieval of Advanced Search instance configurations and sensitive credentials through server object lookup.
Which GitLab EE releases need remediation?
Affected releases are 18.3 through versions before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Updating to 19.1.8, 19.2.6, 19.3.2, or a later release outside the affected ranges remediates the issue.