GitLab GraphQL Duo Chat Subscription Deserialization Exploit (CVE-2026-87719)

Arnold Chan@slaz

•updated Sep 11, 2026•0•0•5

Detects anomalous serialized object payloads within authenticated GraphQL subscription requests to GitLab Duo Chat endpoints. This pattern is indicative of exploitation attempts targeting the insecure deserialization vulnerability in GitLab EE (CVE-2026-87719), where malicious payloads are injected into serialized data streams.