Loading vulnerability…
Insecure Deserialization in GitLab EE GraphQL Subscriptions
CVE-2026-87719 is an insecure deserialization vulnerability in the GitLab Enterprise Edition GraphQL subscription serializer. An authenticated user with Duo Chat access can submit a specially crafted GraphQL subscription argument to bypass serialization controls and perform server object lookup, exposing Advanced Search instance configurations and sensitive credentials. Affected versions are 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The vulnerability has a CVSS v3.1 score of 9.9.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes Advanced Search instance configuration data and sensitive credentials, including stored Elasticsearch and OpenSearch passwords. Stolen credentials could enable unauthorized access to associated search infrastructure, subject to network reachability and the credentials' permissions. Arbitrary code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patching is complete, restrict Duo Chat access to trusted users and limit GitLab instance access to trusted networks. Monitor GraphQL subscription activity for anomalous arguments and review application logs for unauthorized access. These measures reduce exposure but do not replace upgrading.
Patch, then assume compromise.
Upgrade affected self-managed GitLab EE installations to 18.11.12, 19.0.9, 19.1.8, 19.2.6, or 19.3.2, or a later fixed release in the applicable branch. Prefer a current supported release because the 18.11.12 and 19.0.9 backports contain only selected critical fixes. GitLab.com and GitLab Dedicated were already patched and require no customer action.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
54 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.