GitLab patches a SAML-to-LDAP account takeover and OIDC discovery cache poisoning

GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 on October 21, fixing 12 vulnerabilities in Community and Enterprise editions. Beside a CVSS 10.0 unauthenticated RCE (CVE-2026-110264), three fixes sit in the identity layer. CVE-2026-15723 (CVSS 8.2) let an authenticated user take over an existing LDAP-backed account with no action from the victim when OmniAuth SAML and LDAP auto-linking were both enabled, because the LDAP email lookup used during identity linking did not sanitize input. CVE-2026-112212 (CVSS 7.5) let an unauthenticated user poison a shared cache's OAuth/OIDC discovery document and redirect some flows to an attacker server. CVE-2026-16255 (CVSS 5.9) let users add project and group members outside the IdP's control despite the instance-wide SAML or LDAP membership lock. GitLab reported no exploitation.

Why it matters

Account linking is where two identity sources meet, and the join key is usually an email address. If one side lets an attacker influence the lookup, a SAML login lands on someone else's LDAP account. The discovery bug is the same lesson from another angle: a client that trusts a cached metadata document trusts whoever wrote to the cache.

Upgrade self-managed instances now; the CVSS 10 RCE alone justifies it, and the patch includes database migrations, so plan downtime for single-node installs. Until then, consider turning off LDAP auto-linking for OmniAuth providers. After upgrading, review recent identity links between SAML and LDAP accounts, and audit project and group memberships added while the membership lock was on.

Source: GitLab