GitLab: SAML/LDAP auto-linking lets an authenticated user take over an LDAP-backed account

Impact

When OmniAuth SAML and LDAP auto-linking are both enabled, improper sanitization in the LDAP email lookup used during identity linking lets an already-authenticated user bind their SAML identity to someone else's LDAP-backed account, with no action from the target. On a GPU fleet where GitLab holds the CI pipelines, runner registration tokens and deploy credentials that push images and job definitions onto the cluster, taking over an operator or maintainer account is a path into what runs on the nodes. The scope-change in the vector reflects that the compromise lands on the identity provider boundary rather than only GitLab itself. Affects all versions from 10.1 up to the fixed releases.

Who can reach it

Network, authenticated: any user who can log into the GitLab instance. Requires the instance to have both OmniAuth SAML and LDAP auto-linking enabled; instances without that combination are not exposed.

What to do

Upgrade to GitLab 19.3.6, 19.4.3 or 19.5.1 per the patch release. For a self-managed instance this is a package upgrade and a restart of the GitLab services; no node reboot. If the upgrade cannot be scheduled immediately, disabling LDAP auto-linking for OmniAuth removes the precondition.

References

Related entries

• IBM AIX and PowerVM VIOS: improper authentication allows remote access to NFS exportsCVE-2026-16686 · IBM AIX / PowerVM VIOS NFS server (export authentication)High
• Cisco Intersight Device Connector for Nutanix Prism Central: The device connector exposes an unauthenticated APICVE-2026-5944 · Cisco Intersight Device Connector for Nutanix Prism CentralHigh
• OpenChoreo Backstage backend: hardcoded auth bypass exposes /api/* to unauthenticated callersCVE-2026-73666 · OpenChoreo Backstage backend (default auth policy)High
• HPE OneView: remotely exploitable session hijacking against the infrastructure management consoleCVE-2026-76718 · HPE OneView (web interface, session handling)High
• GitLab CE/EE: unsanitized Markdown JSON table content induces state-changing requests as a targeted userCVE-2026-78252 · GitLab CE/EE (Markdown JSON table renderer)High
• Ansible automation-controller: unauthenticated debug endpoints grab the scheduler lock and stall job dispatchCVE-2026-84486 · Red Hat Ansible Automation Platform automation-controller (unauthenticated scheduler debug views)High