GitLab CE/EE WebSocket exposed method access control bypass
CVE-2026-5173 is a high-severity improper access control vulnerability in GitLab Community Edition and Enterprise Edition affecting the WebSocket connection layer. In affected versions, the WebSocket handler did not properly restrict which internal server-side methods could be invoked by an authenticated user. As a result, a user with low privileges could authenticate to GitLab, establish a WebSocket connection, and send messages that invoke unintended internal methods that should not have been reachable through that interface. The issue affects GitLab CE/EE versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python proof-of-concept for CVE-2026-5173 targeting GitLab WebSocket/GraphQL functionality. It contains two files: a single executable Python script (CVE-2026-5173.py) and a README with usage, affected versions, and lab setup guidance. The exploit logic is straightforward: it normalizes a supplied target URL, converts it to a WebSocket endpoint by appending /-/cable, sets an Origin header matching the target, connects with the Python websockets library, subscribes to the GitLab ActionCable GraphqlChannel, and then iterates through a hardcoded list of candidate GraphQL methods. For each method it sends an ActionCable message with action=execute and a GraphQL query intended to retrieve user or node data. Responses containing "data" or "result" are treated as signs of successful unauthorized access and printed to stdout. Main capabilities: WebSocket connection to GitLab, GraphqlChannel subscription, enumeration of multiple likely sensitive GraphQL methods, and display of returned data that may include users, projects, namespaces, statistics, or internal/admin-related objects. There is no post-exploitation payload, persistence, shell, or command execution. The script is best characterized as a research PoC for unauthorized data access validation rather than a full weaponized exploit. Notable implementation detail: although the README claims support for a Personal Access Token and the CLI accepts --token, the token is never used in headers, cookies, or messages. That means authentication handling is incomplete in the actual code. Overall, this is a minimal network/web exploit PoC focused on probing GitLab's /-/cable WebSocket endpoint for unauthorized GraphQL method execution and data disclosure.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity GitLab CE/EE websocket vulnerability that could let an authenticated attacker bypass access controls and invoke unintended server-side methods.
A high-severity GitLab vulnerability that allows an authenticated attacker to execute unintended server-side commands through WebSocket connections because of improper access controls.
An improper access control vulnerability in GitLab CE/EE that could allow an authenticated user to invoke unintended server-side methods through websocket connections.
An improper access control vulnerability in GitLab CE/EE websocket connections that could allow an authenticated user to invoke unintended server-side methods.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.