EUVD-2026-76778
GHSA-prp4-5w2g-8v2c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Duo Chat-enabled account
-
DeliveryCraft malicious GraphQL subscription argument
-
ExploitBypass serialization allow-list
-
ExecutionForce server-side object lookup
-
PersistRead Advanced Search config and credentials
-
ImpactReuse credentials against search backend
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated GitLab EE account (PR:L) that specifically has GitLab Duo Chat access enabled - Duo Chat is a licensed AI add-on, so instances without it provisioned are not exploitable. The deployment must be GitLab EE in the affected ranges (18.3-<19.1.8, 19.2-<19.2.6, 19.3-<19.3.2). The attack is performed remotely over the network (AV:N) with no user interaction by sending a crafted GraphQL subscription argument that bypasses serialization. GitLab's own qualifier 'under certain conditions' and the requirement that the Advanced Search integration be configured (so that credentials exist to leak) further limit which instances yield sensitive data. |
| Impact | The published CVSS is 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network vector, low complexity, low privileges, no user interaction, and scope change. Publicly available exploit code raises real-world risk relative to a theoretical bug, and vendor (GitLab) reporting plus a HackerOne report lend credibility. However, the described impact is dominated by confidentiality - obtaining Advanced Search configuration and credentials - so the I:H/A:H components of the vendor score appear overstated for the described primary effect; the integrity/availability exposure is largely indirect, arising only after the leaked credentials are reused against the backing search cluster. Two limiting factors temper the raw score: exploitation requires an authenticated account (PR:L) and, specifically, an account with Duo Chat access, and the description qualifies the issue as occurring 'under certain conditions.' No EPSS value was provided and there is no CISA KEV entry, so treat this as POC-available-but-not-confirmed-in-the-wild. Net: a genuine high priority for GitLab EE operators who have Duo Chat enabled, but not an unauthenticated internet-wide worm-class issue. |
| Exploit ScenarioDerived | An attacker who holds (or phishes/registers) a low-privileged GitLab EE account that has Duo Chat access sends a specially crafted GraphQL subscription argument that bypasses the expected serialization/allow-list check. The backend resolves an out-of-scope server object and returns the Advanced Search integration configuration and its stored credentials, which the attacker then uses to reach the backing Elasticsearch cluster. A public proof-of-concept for this chain exists on HackerOne (report #4012289). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 12, 2026
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Chat access to exfiltrate Advanced Search (Elasticsearch) instance configurations and stored credentials by supplying a specially crafted GraphQL subscription argument that bypasses serialization and forces an internal server object lookup. It affects EE 18.3 through 19.1.8, 19.2 through 19.2.6, and 19.3 through 19.3.2, was reported by GitLab, and publicly available exploit code exists (HackerOne #4012289). No CISA KEV listing at time of analysis, so this is POC-backed but not confirmed as actively exploited.
RemediationAI
Vendor-released patch: upgrade to GitLab EE 19.1.8, 19.2.6, or 19.3.2 (or later) depending on your release branch - these are the fixed versions per the GitLab advisory at https://gitlab.com/gitlab-org/gitlab/-/work_items/628160. If immediate patching is not possible, restrict or disable Duo Chat access for untrusted or low-trust users since the vulnerability requires an account with Duo Chat access, which reduces the exploitable population at the cost of losing AI assistant functionality for those users. Because the leaked data is Advanced Search credentials, treat the underlying Elasticsearch/OpenSearch credentials as potentially compromised on affected instances and rotate them after patching, and restrict network access to the search backend so leaked credentials cannot be reused from arbitrary locations. Review GraphQL/API access logs for anomalous subscription requests as a detection compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an insecure deserialization / object-lookup abuse (CWE-502) reachable through GitLab's GraphQL subscription layer. GitLab Duo Chat is GitLab's AI assistant feature (EE/licensed), and its GraphQL subscription handling deserializes a client-supplied argument that is expected to reference an allowed object; by crafting the argument to bypass the serialization/allow-list logic, an attacker coerces the backend into resolving an arbitrary server-side object. This is used to reach the Advanced Search integration, which stores the connection configuration and credentials for the backing Elasticsearch/OpenSearch cluster (GitLab's Advanced Search feature). The affected component is the Ruby-on-Rails GraphQL API of GitLab EE (cpe:2.3:a:gitlab:gitlab), and the root cause is trusting attacker-controlled serialized input to perform a global object lookup rather than restricting it to the subscriber's authorized scope.
Know when Gitlab gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated Duo Chat user (PR:L) over network leaks other-system credentials/config (S:C, C:H); integrity impact only indirect via reused creds (I:L) and no direct availability impact (A:N).
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
2DescriptionCVE.org
GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.
Articles & Coverage 1
Executive ViewAI
GitLab Enterprise Edition versions 18.3 through 19.3.2 contain a critical vulnerability allowing authenticated users with Duo Chat access to exfiltrate Advanced Search (Elasticsearch) instance credentials and configurations through a GraphQL subscription bypass. Publicly available exploit code exists. Compromise of Elasticsearch credentials directly exposes sensitive enterprise data and enables lateral movement to connected infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Duo Chat feature to essential personnel, implement network segmentation between GitLab and Elasticsearch, rotate Elasticsearch credentials, enable audit logging for GraphQL subscriptions, and monitor for unauthorized database access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Related Vulnerabilities in GitLab CE/EE Critical Remote Code and File Read Flaws
View all 2An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2)
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Remote code execution in GitLab CE/EE can be triggered by a specially crafted regular expression processed through a vul
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer over
Authenticated users who can define or modify a CI/CD configuration can achieve remote code execution on GitLab CE/EE ser
Exploit-DB