The record GitLab published overnight names the AI assistant as the entry condition and instance credentials as the payoff — two details that were not in the release notes, and not in this site’s own story about the same release.
What happened
NVD published the record for CVE-2026-87719 at 3:16 a.m. UTC on Saturday, September 12, 2026 — the same minute it published the record for CVE-2026-85706, the 10.0 path traversal from the same GitLab patch release that went on the Known Exploited Vulnerabilities catalog Thursday with a Monday deadline. Both records came from GitLab as CNA. Only one of them has been read closely.
The description for CVE-2026-87719, verbatim: “GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.”
The record is marked Received. The only CVSS data on it is secondary, from [email protected]: 9.9, Critical, from the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, with an exploitability subscore of 3.1 and an impact subscore of 6.0. The weakness is CWE-502, deserialization of untrusted data. The two references are a GitLab work item and a HackerOne report; neither is readable without credentials.
This publication covered the patch release on September 11 and described this flaw, from the release notes available then, as an insecure deserialization issue in the GraphQL subscription serializer scored 9.9 and affecting Enterprise Edition from 18.3. That was accurate as far as it went. It omitted the two facts a reader needs to decide whether this applies to them: who can reach it, and what they get.
Who can reach it: “an authenticated user with Duo Chat access.” The vector’s PR:L agrees — low privileges, not administrative ones.
What they get: “Advanced Search instance configurations and sensitive credentials.” The record does not say what those credentials authenticate to, and neither reference is reachable to say more, so this story does not assert it. What can be said from the vector alone is that S:C is set. Scope is marked Changed, which in CVSS terms means the impact lands outside the component that contains the flaw.
The mechanism, in the record’s own words, is “a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.” GraphQL subscriptions have to survive across requests, which means the server serializes references to objects and resolves them again later. CWE-502 plus “perform server object lookup” describes an argument that survives that round trip and points the resolver somewhere it should not go. That is a reading of the record’s phrasing, not a vendor-confirmed mechanism; GitLab has published no public writeup this story could reach.
CVE-2026-87719 is not in the Known Exploited Vulnerabilities catalog. The mirror read for this story, catalog version 2026.09.11, contains four additions dated September 11, and this is not among them. No source checked reports exploitation of it. The fix versions are the same as for the 10.0: 19.1.8, 19.2.6, and 19.3.2.
Why it matters
The entry condition is the part that should change how an administrator thinks about this. Duo Chat is a productivity feature. It is the kind of thing that gets enabled at the group or instance level, for everyone, because the point of an assistant is that people use it. It is not a privilege anybody audits, because until this record was published there was no reason to think of it as a privilege at all. A permission model that grants chat access to every developer and a permission model that grants credential access to every developer are, for the duration of this flaw, the same model.
Earlier tonight this site covered a vLLM flaw in which the flag meant to stop untrusted model code from running was silently discarded by a loader. The two have nothing in common technically. What they share is shape: a capability added for AI, wired through plumbing that predates it, arriving with a permission grant nobody had yet learned to treat as security-relevant. The pattern is not that AI features are written worse. It is that an assistant needs broad read access to be useful, it usually gets that access through the same API surface as everything else, and the threat model it lands in was written before the feature existed.
Then there is the way this flaw has been ranked, in practice, by everyone including this publication. It scored 9.9, which is a number that in most weeks leads a bulletin. It arrived alongside a 10.0 that is on KEV with a federal deadline on Monday, and so it became the second item. Coverage of the release, this site’s included, treated it as the thing to mention after the main thing. That is a reasonable editorial instinct and it is also how a critical flaw gets under-patched: an organization that reads a summary, sees one headline CVE, and applies the upgrade will in this case be fine, because the upgrade is the same. An organization that reads a summary and applies a targeted workaround for the path traversal — there are people doing exactly that, because the 10.0 is the one with a deadline — will have addressed the flaw with the deadline and left the one with the credentials.
Finally, the record is once again carrying detail the release notes did not. GitLab authored both. The same organization, as CNA, wrote a CVE description that names Duo Chat and credential disclosure, and as vendor wrote release notes that described a serializer issue. Neither is wrong. But operators read release notes on the day and CVE records weeks later, if at all, and in this case the document that arrived a day late is the one that tells you whether to care.
What to do
Upgrade self-managed GitLab to 19.1.8, 19.2.6, or 19.3.2, whichever matches your branch. This is the same release that closes CVE-2026-85706, which federal civilian agencies must remediate by Monday, September 14, 2026. If you were planning that upgrade for the path traversal, you are already covered here; if you were planning a mitigation instead of the upgrade, reconsider.
This one is Enterprise Edition only, and it reaches back to 18.3 — further back than the 10.0, which starts at 18.7. An 18.3 through 18.6 Enterprise instance that concluded it was out of scope for the path traversal is in scope for this.
Until you have upgraded, treat Duo Chat access as a privileged grant. Enumerate who has it. If your instance enables it broadly and you cannot upgrade today, turning it off for the interval is a mitigation that matches the record’s stated entry condition, though GitLab has published no mitigation guidance this story could reach, and that is a judgment rather than vendor advice.
Afterward, rotate whatever credentials your Advanced Search configuration holds. The record says they were obtainable by any user with chat access; an upgrade stops further disclosure and does nothing about disclosure that already happened.
Sourcing note
Checked: the NVD record for CVE-2026-87719, published at 3:16 a.m. UTC on September 12, 2026, vulnStatus Received, with GitLab as the CVSS source — the vendor authored this record as CNA, which makes it a primary source for the description and score quoted above. Also checked: the NVD record for CVE-2026-85706 and this site’s two earlier stories on that flaw. The Known Exploited Vulnerabilities catalog was read from the cisagov/kev-data GitHub mirror, catalog version 2026.09.11, released at 7:32 p.m. UTC on September 11, because cisa.gov returns 403 to automated fetching; CVE-2026-87719 does not appear in it. Could not reach: both references on the record — GitLab work item 628160 and HackerOne report 4012289 — returned nothing readable, the HackerOne page with a 403; and GitLab’s patch release notes page redirects to a documentation index that does not list the September patch release, so the vendor’s own advisory wording for this CVE was not re-read for this story. Unresolved: what system the “sensitive credentials” authenticate to; whether GitLab considers Duo Chat access a mitigating control or simply a precondition; and whether any mitigation short of upgrading exists.