An authenticated remote code execution vulnerability in GitLab allows attackers to bypass security controls and access sensitive environment credentials.

This flaw involves the deserialization of untrusted data through a GraphQL subscription argument, which permits an authenticated user with Duo Chat privileges to perform unauthorized server object lookups. The vulnerability effectively allows for privilege escalation and the extraction of sensitive instance configurations.

The vulnerability carries a critical CVSS score of 9.9, reflecting the high potential for full system compromise. Successful exploitation enables unauthorized access to sensitive credentials and internal configurations, which could lead to a complete breach of the development environment, intellectual property theft, or further lateral movement into the corporate network.

Immediate Action: Upgrade all affected GitLab instances to version 19.1.8, 19.2.6, 19.3.2, or later immediately.

Proactive Monitoring: Review GraphQL subscription logs for unusual, malformed, or highly complex arguments that deviate from standard interaction patterns.

Compensating Controls: Restrict access to Duo Chat features for non-essential users and ensure that Web Application Firewalls are configured to inspect and filter suspicious GraphQL traffic payloads.

Public Exploit Available: Yes, a published proof-of-concept exists via the referenced HackerOne report.

Given the critical nature of this vulnerability and the availability of technical details regarding the exploit mechanism, organizations must prioritize patching. Failure to update to the specified versions leaves the instance vulnerable to credential theft and potential remote code execution. Apply the recommended updates immediately to maintain the integrity of your development and production environments.