# GitLab patches a SAML-to-LDAP account takeover and OIDC discovery cache poisoning

Source: https://startwithidentity.com/blog/2026-10-21-gitlab-patches-saml-ldap-account-takeover-and-oidc-discovery-cache-poisoning/
Last updated: 2026-10-21
License: content by Start with Identity. Cite the source URL.

---

GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 on October 21, fixing 12 vulnerabilities in Community and Enterprise editions. Beside a CVSS 10.0 unauthenticated RCE (CVE-2026-110264), three fixes sit in the identity layer. CVE-2026-15723 (CVSS 8.2) let an authenticated user take over an existing LDAP-backed account with no action from the victim when OmniAuth [SAML](https://startwithidentity.com/glossary/saml/) and LDAP auto-linking were both enabled, because the LDAP email lookup used during identity linking did not sanitize input. CVE-2026-112212 (CVSS 7.5) let an unauthenticated user poison a shared cache's OAuth/[OIDC](https://startwithidentity.com/glossary/oidc/) discovery document and redirect some flows to an attacker server. CVE-2026-16255 (CVSS 5.9) let users add project and group members outside the IdP's control despite the instance-wide SAML or LDAP membership lock. GitLab reported no exploitation.

## Why it matters

Account linking is where two identity sources meet, and the join key is usually an email address. If one side lets an attacker influence the lookup, a SAML login lands on someone else's [LDAP](https://startwithidentity.com/glossary/ldap/) account. The discovery bug is the same lesson from another angle: a client that trusts a cached metadata document trusts whoever wrote to the cache.

Upgrade self-managed instances now; the CVSS 10 RCE alone justifies it, and the patch includes database migrations, so plan downtime for single-node installs. Until then, consider turning off LDAP auto-linking for OmniAuth providers. After upgrading, review recent identity links between SAML and LDAP accounts, and audit project and group memberships added while the membership lock was on.

Source: [GitLab](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)