GitLab EE Patches CVSS 9.9 Duo Chat Flaw Exposing Search Credentials

Executive Summary

GitLab has shipped an emergency patch for CVE-2026-87719, a critical information-disclosure flaw in GitLab Enterprise Edition rated CVSS 9.9. Under certain conditions, an authenticated user with Duo Chat access can send a specially crafted GraphQL subscription argument that bypasses the platform's serialization logic and performs an unintended server-side object lookup — surfacing Advanced Search instance configuration data and sensitive credentials that should never leave the server.

CVSS Score: 9.9 (Critical)

The vulnerability was reported through GitLab's HackerOne bug bounty program and fixed in versions 19.1.8, 19.2.6, and 19.3.2, released September 10, 2026. GitLab.com has already received the patch; GitLab Dedicated customers do not need to take action.

Vulnerability Overview

The root cause sits in the GraphQL subscription serializer used by Duo Chat when it queries Advanced Search state. A malformed subscription argument subverts the expected serialization flow and lets the server resolve an object it should have refused to return, leaking Advanced Search configuration values and embedded credentials to the requesting user.

Affected Versions

Related Fixes in the Same Release

GitLab's September 10 security release bundled two other notable issues alongside CVE-2026-87719:

Researchers have already observed active reconnaissance/probing traffic against CVE-2026-85706. CVE-2026-87719 had not been confirmed as actively exploited at time of writing, but given the low bar (any Duo Chat user) and the value of the exposed credentials, exploitation attempts should be expected quickly.

Attack Vector

1. Attacker obtains or already holds a low-privileged account with Duo Chat access
2. Attacker crafts a GraphQL subscription request with a malicious argument
   targeting Advanced Search resolution logic
3. Vulnerable serializer bypasses expected validation and performs a
   server-side object lookup
4. Advanced Search instance configuration and embedded credentials are
   returned in the GraphQL response
5. Attacker reuses leaked credentials against the Advanced Search backend
   or pivots to further compromise

Immediate Remediation

Step 1: Upgrade Immediately

Upgrade self-managed instances to the fixed version for your branch:

# Example for the 19.3 branch
sudo gitlab-ctl reconfigure
sudo apt-get update && sudo apt-get install gitlab-ee=19.3.2-ee.0

Confirm the installed version:

gitlab-rake gitlab:env:info | grep "GitLab information"

Step 2: Rotate Advanced Search Credentials

Because the flaw discloses live configuration values, treat any Advanced Search (Elasticsearch/OpenSearch) credentials on affected instances as compromised:

1. Rotate the Advanced Search connection credentials
2. Rotate any API keys stored alongside that configuration
3. Review Elasticsearch/OpenSearch access logs for unfamiliar source IPs

Step 3: Audit Duo Chat Access

1. Review which users and groups currently hold Duo Chat access
2. Restrict Duo Chat to users who genuinely need it until the patch is confirmed deployed
3. Check GraphQL subscription logs for anomalous or malformed arguments

If Immediate Patching Is Not Possible

1. Restrict Duo Chat access to a minimal trusted set of accounts
2. Monitor GraphQL query logs for unusual subscription activity tied to Advanced Search
3. Consider disabling Advanced Search integration temporarily on exposed instances

Post-Remediation Steps

1. Confirm the upgrade to 19.1.8, 19.2.6, or 19.3.2 (or later)
2. Rotate all Advanced Search credentials, even if you don't have direct evidence of exploitation
3. Review GraphQL access logs retroactively for suspicious subscription patterns
4. Re-audit Duo Chat permissions and apply least-privilege going forward
5. Track CVE-2026-85706 and CVE-2026-88765 from the same release — patch all three together

References

• The Hacker News — GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
• BleepingComputer — GitLab Urges Users to Patch Max Severity Path Traversal Flaw
• GBHackers — Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code
• NIST NVD — CVE-2026-87719

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• WordPress Plugin Vulnerability (CVSS 10.0) Under Active