GitLab Credential Theft Following Duo Chat GraphQL Deserialization (CVE-2026-87719)

Arnold Chan@slaz

•updated 24 days ago•0•0•5

Detects anomalous credential retrieval activity occurring within 30 minutes of a GitLab Duo Chat GraphQL subscription request. This pattern is indicative of potential exploitation of CVE-2026-87719, which involves insecure deserialization within the GitLab EE GraphQL subscription serializer to facilitate unauthorized credential access.