Is CVE-2026-87719 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87719 being exploited in the wild.

How severe is CVE-2026-87719?

Critical severity, with a CVSS score of 9.9, published 12 September 2026.

Which products and versions are affected?

GitLab EE 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2.

Is there a fix for CVE-2026-87719?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-87719 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-87719?

Check whether you run GitLab EE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87719: GitLab EE GraphQL deserialization in Duo Chat

CVE-2026-87719 · Severity: critical · CVSS 9.9 · Published 2026-09-12

GitLab Enterprise Edition contains a vulnerability in its AI-powered Duo Chat feature that allows authenticated users to bypass security controls and extract sensitive configuration data and credentials from the Advanced Search system. An attacker with legitimate access to Duo Chat can craft specially designed requests to expose database connection strings, API keys, and other secrets that should be protected, potentially leading to further system compromise or unauthorized access to integrated services.

Technologies: GitLab EE. Vendors: GitLab.

Quick answers

Is CVE-2026-87719 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87719 being exploited in the wild.
How severe is CVE-2026-87719?: Critical severity, with a CVSS score of 9.9, published 12 September 2026.
Which products and versions are affected?: GitLab EE 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2.
Is there a fix for CVE-2026-87719?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87719 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-87719?: Check whether you run GitLab EE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a deserialization and object lookup flaw in GitLab EE's GraphQL API, specifically in the Duo Chat subscription handling. An authenticated user can exploit improper serialization filtering in GraphQL subscription arguments to bypass intended access controls and perform arbitrary server object lookups, gaining access to Advanced Search instance configurations and credentials. The attack requires authentication with Duo Chat access but no additional user interaction. The vulnerability affects GitLab EE versions 18.3 through 19.3 with patches available in 18.11.12, 19.0.9, 19.1.8, 19.2.6, and 19.3.2. The flaw enables information disclosure of sensitive operational data that could be leveraged for lateral movement or supply chain attacks on integrated systems.

Affected products

GitLab GitLab EE 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2

Timeline

2026-09-12: disclosed: Vulnerability published and patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.