CVE-2026-15723: GitLab SAML LDAP Account Takeover Vulnerability

CVE-2026-15723 Overview

CVE-2026-15723 is an LDAP injection vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw lets an authenticated attacker take over an existing LDAP-backed account without any interaction from the targeted user. The root cause is improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking. Exploitation requires that OmniAuth Security Assertion Markup Language (SAML) and LDAP auto-linking are both enabled. The weakness is classified under CWE-90: Improper Neutralization of Special Elements used in an LDAP Query.

Critical Impact

An authenticated attacker can hijack LDAP-backed GitLab accounts, gaining access to source code, pipelines, and project secrets owned by the victim.

Affected Products

• GitLab CE/EE versions 10.1 through 19.3.5
• GitLab CE/EE versions 19.4 through 19.4.2
• GitLab CE/EE version 19.5.0

Discovery Timeline

• 2026-10-22 - CVE-2026-15723 published to the National Vulnerability Database (NVD)
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-15723

Vulnerability Analysis

The vulnerability lives in the OmniAuth identity-linking flow that reconciles an incoming SAML assertion with an existing GitLab user record. When LDAP auto-linking is enabled, GitLab queries LDAP for a user matching the email supplied through the SAML identity. The lookup path fails to sanitize input before constructing the LDAP filter. An authenticated attacker can inject LDAP metacharacters that alter the filter semantics and resolve to a different user object than intended. GitLab then links the attacker's OmniAuth identity to the victim's LDAP-backed account, granting the attacker login access as the victim.

Root Cause

The flaw is an LDAP injection (CWE-90) in the email lookup used during OmniAuth identity linking. User-controllable email values are concatenated into an LDAP search filter without escaping reserved characters such as *, (, ), \, and NUL. The resulting filter can be coerced into matching the Distinguished Name (DN) of an unintended account. The scope-changed nature of the attack reflects that the compromised identity crosses from the attacker's authentication context into the victim's account authority.

Attack Vector

The attack is remote and requires low privileges in the form of a valid, authenticated session on the target GitLab instance. No user interaction is required from the victim. The attacker initiates an OmniAuth SAML authentication supplying a crafted email attribute. GitLab issues an LDAP search for the supplied email, the injected filter matches the victim's LDAP entry, and GitLab links the attacker's SAML identity to the victim account. Subsequent SAML logins by the attacker authenticate as the victim. Exploitation is bounded by two prerequisites: both OmniAuth SAML and LDAP auto-linking must be enabled on the instance.

No verified public exploit code is available. See the HackerOne Report #3852192 and the GitLab Work Item #605977 for technical details.

Detection Methods for CVE-2026-15723

Indicators of Compromise

• Unexpected identities table entries linking SAML extern_uid values to LDAP-backed users that did not previously have a SAML identity.
• OmniAuth authentication events where the asserted email contains LDAP metacharacters such as *, (, ), or \.
• LDAP search queries originating from GitLab containing filter fragments that deviate from the expected (mail=<email>) template.
• Successful logins immediately following an identity-linking event from a source IP that does not match the victim's historical login pattern.

Detection Strategies

• Audit the GitLab audit_events and application.log entries for OmniAuth::AuthHash processing with abnormal email attribute values.
• Correlate SAML identity creation events with subsequent authentications and flag cases where the authenticating IP, user agent, or geolocation diverges from the victim's baseline.
• Replay recent LDAP queries from the GitLab application against directory server logs to identify malformed filters consistent with injection attempts.

Monitoring Recommendations

• Enable verbose OmniAuth and LDAP logging and forward logs to a centralized analytics platform for retention and search.
• Alert on any new identity link to a privileged user, service account, or administrator role.
• Review LDAP directory audit logs for search filters that reference multiple attributes or wildcards in a single OmniAuth-triggered lookup.

How to Mitigate CVE-2026-15723

Immediate Actions Required

• Upgrade GitLab CE/EE to version 19.3.6, 19.4.3, or 19.5.1 as applicable to your release branch.
• If immediate patching is not possible, disable either OmniAuth SAML or LDAP auto-linking until the upgrade is applied.
• Review the identities table for SAML links created since the vulnerability window and revoke any entries that cannot be reconciled with legitimate user activity.
• Force a password and session reset for LDAP-backed accounts that show evidence of unauthorized identity linking.

Patch Information

GitLab released fixed builds in the 19.5.1, 19.4.3, and 19.3.6 patch cycles. Refer to the GitLab Release Patch Notes for upgrade instructions and backport details. The fix enforces proper escaping of email input before constructing LDAP search filters in the OmniAuth identity-linking path.

Workarounds

• Disable LDAP auto-linking in gitlab.rb by setting the OmniAuth auto_link_ldap_user option to false.
• Alternatively, disable the OmniAuth SAML provider until the upgrade is complete.
• Restrict GitLab administrative access and SAML provider configuration changes to a limited set of accounts protected by multi-factor authentication.

# Configuration example: disable LDAP auto-linking in /etc/gitlab/gitlab.rb
gitlab_rails['omniauth_auto_link_ldap_user'] = false

# Apply the configuration change
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart