Free practical cybersecurity guidance for organisations without a security team.
hello@actionsoncyber.com
Actions On Cyber logo
Contact
← Back to Vulnerability Briefs

Critical Security Flaw Found in GitLab Could Expose Sensitive Information

A serious security issue has been found in certain versions of GitLab Enterprise Edition that could allow someone with limited access to see sensitive system settings and credentials. This matters because it could let attackers gain deeper access to your systems if not fixed.

15 September 2026

Reference: CVE-2026-87719

1. What is being reported?

The problem affects specific versions of GitLab Enterprise Edition used for software development and collaboration. Under certain conditions, a user who can access Duo Chat within GitLab could exploit a flaw to bypass normal security checks and view advanced search settings and sensitive credentials stored on the server.

2. What this means in plain English

If your organisation uses the affected GitLab versions, an attacker who already has some access could use this flaw to gather sensitive information that might help them take over more of your system or data. This could lead to data breaches or disruption of your services.

3. Could this affect a small business?

Small businesses or charities using the affected GitLab versions with Duo Chat enabled could be at risk, especially if multiple users have access to the system. Organisations not using GitLab Enterprise Edition or not using Duo Chat are unlikely to be affected.

4. What to do now

  • Check if your GitLab Enterprise Edition version is one of those affected (versions from 18.3 before 19.1.8, 19.2 before 19.2.6, or 19.3 before 19.3.2).
  • If affected, update GitLab to the latest fixed version as soon as possible.
  • Review who has Duo Chat access and limit it to trusted users only.
  • Ask your IT provider to confirm that your GitLab installation is secure and patched.

5. Ask your IT provider

Can you confirm whether our GitLab Enterprise Edition is affected by CVE-2026-87719 and if it has been updated to a secure version?

6. Bottom line

If you use GitLab Enterprise Edition, make sure it is updated promptly to prevent attackers from accessing sensitive system information.

Information based on NVD, CISA KEV, and reputable security reporting.

Back to Vulnerability Briefs