CVE-2026-15723: 
GitLab vulnerability analysis and mitigation

CVE-2026-15723 is an LDAP Injection vulnerability in GitLab CE/EE that allows an authenticated user to take over an existing LDAP-backed account without any interaction from the targeted user. The flaw exists when both OmniAuth SAML and LDAP auto-linking are enabled, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking. It affects all GitLab CE/EE versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. The vulnerability carries a CVSS v3.1 base score of 8.2 (High) (ENISA EUVD, GitLab Issue).

The root cause is classified as CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query — LDAP Injection), mapped to CAPEC-136. When OmniAuth SAML and LDAP auto-linking are simultaneously enabled, the LDAP email lookup path used during OmniAuth identity linking fails to properly sanitize user-controlled input, allowing an attacker to manipulate the LDAP query to match and link to an arbitrary LDAP-backed account. The attack is network-based, requires low privileges (an existing authenticated session), no user interaction from the victim, and has a changed scope — meaning the impact extends beyond the attacker's own account. The vulnerability was reported via HackerOne (HackerOne Report, GitLab Issue).

Successful exploitation allows an authenticated attacker to fully take over any LDAP-backed GitLab account, gaining access to that account's repositories, CI/CD pipelines, secrets, and group memberships without any action required from the victim. This results in high confidentiality and integrity impact — an attacker could exfiltrate source code, inject malicious code into pipelines, or escalate privileges by hijacking administrator accounts. Availability is not directly impacted, but the scope change means the compromise extends beyond the attacker's own account to other users and resources within the GitLab instance (ENISA EUVD, GitLab Issue).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (ENISA EUVD). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already be authenticated and the target instance to have both OmniAuth SAML and LDAP auto-linking enabled, which limits the attack surface to specific configurations.

1. Reconnaissance: Identify a GitLab CE/EE instance running a vulnerable version (10.1 through 19.3.5, 19.4.0–19.4.2, or 19.5.0) with both OmniAuth SAML and LDAP auto-linking enabled — this can often be inferred from the GitLab login page showing SAML SSO options.
2. Authenticate: Obtain or create a low-privilege authenticated session on the target GitLab instance (e.g., via a self-registered account or compromised credentials).
3. Initiate OmniAuth identity linking: Trigger the OmniAuth SAML identity linking flow, which initiates an LDAP email lookup to associate the SAML identity with an LDAP account.
4. Inject LDAP payload: Craft a malicious email value containing LDAP special characters (e.g., *, )(, null bytes) in the identity linking request to manipulate the LDAP query and match the email attribute of a target LDAP-backed account (e.g., an administrator).
5. Account takeover: The unsanitized LDAP query resolves to the target account, causing GitLab to auto-link the attacker's SAML identity to the victim's LDAP account, granting the attacker full access to that account without any victim interaction (GitLab Issue, HackerOne Report).

• Logs: GitLab application logs (production.log) showing OmniAuth SAML identity linking events for accounts that do not match expected user behavior; LDAP query logs containing special characters such as *, )(, or null bytes in email fields.
• Logs: Audit log entries showing an existing LDAP-backed account being linked to a new or unexpected SAML identity, especially for privileged accounts.
• Network: Unusual POST requests to GitLab's OmniAuth SAML callback endpoint (/users/auth/saml/callback) from unexpected IP addresses or user agents.
• Application: Unexpected session activity on LDAP-backed accounts (logins from new IPs, new SSH keys added, new personal access tokens created) shortly after an OmniAuth linking event.

GitLab has released patched versions: 19.3.6, 19.4.3, and 19.5.1 — upgrading to one of these versions is the primary recommended remediation (GitLab Patch Release). As an immediate workaround for instances that cannot be patched promptly, administrators should disable either OmniAuth SAML auto-linking or LDAP auto-linking (or both) in the GitLab configuration, as the vulnerability only exists when both features are simultaneously enabled. Additionally, monitor GitLab audit logs for unexpected identity linking events and restrict access to the OmniAuth SAML callback endpoint where feasible.

The vulnerability received coverage from multiple security news outlets including CyberSecurityNews, GBHackers, SecurityOnline, and The Hacker News, with several articles noting the long-standing nature of the flaw (affecting versions back to 10.1, approximately 12 years of releases) (CyberSecurityNews, GBHackers). Community discussion on Infosec.Exchange highlighted the account takeover risk for organizations using SAML+LDAP configurations. Tenable published detection plugins for the vulnerability shortly after disclosure (Tenable).