GitLab EE Duo Chat GraphQL Subscription Insecure Deserialization Leaking Advanced Search Credentials

#!/usr/bin/env bash
# check_cve_2026_87719.sh — Detect CVE-2026-87719 (GitLab EE deserialization)
# Usage: bash check_cve_2026_87719.sh [GITLAB_URL]
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

GITLAB_URL="${1:-}"
VERSION=""
EDITION=""

# Try local Omnibus version file first
if [[ -f /opt/gitlab/version-manifest.txt ]]; then
  VERSION=$(head -1 /opt/gitlab/version-manifest.txt | awk '{print $2}')
  if grep -qi 'gitlab-ee' /opt/gitlab/version-manifest.txt 2>/dev/null; then
    EDITION="ee"
  else
    EDITION="ce"
  fi
fi

# Fall back to API
if [[ -z "$VERSION" && -n "$GITLAB_URL" ]]; then
  API_RESP=$(curl -sf "${GITLAB_URL}/api/v4/version" 2>/dev/null || true)
  if [[ -n "$API_RESP" ]]; then
    VERSION=$(echo "$API_RESP" | grep -oP '"version"\s*:\s*"\K[^"]+' || true)
    if echo "$API_RESP" | grep -qi 'enterprise'; then
      EDITION="ee"
    else
      EDITION="ce"
    fi
  fi
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not determine GitLab version."
  echo "Provide the GitLab URL as argument or run on the GitLab host."
  exit 2
fi

echo "Detected GitLab $VERSION ($EDITION)"

# CE is not affected
if [[ "$EDITION" == "ce" ]]; then
  echo "PATCHED — GitLab CE is not affected by CVE-2026-87719."
  exit 0
fi

# Parse version components
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3 | sed 's/[^0-9].*//')

vulnerable=false

# Not affected if before 18.3
if [[ $MAJOR -lt 18 ]] || { [[ $MAJOR -eq 18 ]] && [[ $MINOR -lt 3 ]]; }; then
  echo "PATCHED — version predates the vulnerable code (introduced in 18.3)."
  exit 0
fi

# 18.3.0 - 18.11.x: fixed in 18.11.12
if [[ $MAJOR -eq 18 ]]; then
  if [[ $MINOR -lt 11 ]]; then
    vulnerable=true
  elif [[ $MINOR -eq 11 ]] && [[ $PATCH -lt 12 ]]; then
    vulnerable=true
  fi
fi

# 19.0.x: fixed in 19.0.9
if [[ $MAJOR -eq 19 ]] && [[ $MINOR -eq 0 ]] && [[ $PATCH -lt 9 ]]; then
  vulnerable=true
fi

# 19.1.x: fixed in 19.1.8
if [[ $MAJOR -eq 19 ]] && [[ $MINOR -eq 1 ]] && [[ $PATCH -lt 8 ]]; then
  vulnerable=true
fi

# 19.2.x: fixed in 19.2.6
if [[ $MAJOR -eq 19 ]] && [[ $MINOR -eq 2 ]] && [[ $PATCH -lt 6 ]]; then
  vulnerable=true
fi

# 19.3.x: fixed in 19.3.2
if [[ $MAJOR -eq 19 ]] && [[ $MINOR -eq 3 ]] && [[ $PATCH -lt 2 ]]; then
  vulnerable=true
fi

if $vulnerable; then
  echo "VULNERABLE — GitLab EE $VERSION is affected by CVE-2026-87719."
  echo "Upgrade to 18.11.12 / 19.0.9 / 19.1.8 / 19.2.6 / 19.3.2 or later."
  exit 1
else
  echo "PATCHED — GitLab EE $VERSION is not affected."
  exit 0
fi