Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab urgently patched CVE-2026-19478 (CVSS 9.4), a critical unauthenticated GraphQL flaw allowing modification or deletion of public projects on self-managed instances.
GitLab released an out-of-band critical patch on August 17, 2026 fixing CVE-2026-19478 (CVSS 9.4), a flaw that under certain conditions lets unauthenticated attackers remotely modify or delete public projects and user data via a GraphQL directive in Community and Enterprise Editions. Fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11; GitLab.com and GitLab Dedicated are already patched, so only self-managed installations need to act. The release also fixes CVE-2026-19650 (CVSS 7.1), a cross-site request forgery flaw in GraphQL multiplex query handling requiring user interaction. No exploitation or public exploit code has been observed as of August 18, 2026.
- Out-of-band patch release issued August 17, 2026, outside the usual schedule
- Fixes in 19.2.4, 19.1.6, 19.0.8, 18.11.11; only self-managed instances affected
- Second flaw CVE-2026-19650 is CSRF in GraphQL multiplex query handling (CVSS 7.1)
- No exploitation observed and no public exploit code as of August 18, 2026
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-19478 +1 in the same advisory: …19650 | Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering GitLab has patched a critical (CVSS 9.1) code injection flaw (CWE-94) in how GitLab Community Edition (CE) and Enterprise Edition (EE) process GraphQL directives. Under certain conditions, an unauthenticated remote attacker can abuse a GraphQL directive to modify or delete public projects and user data on affected instances, requiring no privileges or user interaction; the impact is to integrity and availability, not confidentiality. Affected versions span all GitLab CE/EE releases from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4, which covers self-managed installations as well as the same codebase that powers the GitLab.com SaaS. News reports indicate the flaw came under active exploitation within days of disclosure, and EPSS assigns a 5.8% probability of exploitation within 30 days (93rd percentile). It is not yet listed in CISA's KEV catalog and no public proof-of-concept is known, but defenders should treat it as an actively exploited, unauthenticated, high-impact issue. Do: Upgrade all GitLab CE/EE instances to 18.11.11, 19.0.8, 19.1.6, or 19.2.4 (or later) immediately, prioritizing internet-facing instances given confirmed active exploitation. Until patched, restrict unauthenticated access to the GraphQL API endpoint at the network or WAF layer. Review instance audit logs and public projects for signs of unauthorized modifications or deletions of projects and user data. | 9.1 group max | 6% |
| massmillions of users (GitLab.com SaaS runs the same code) plus tens of thousands of internet-exposed self-managed CE/EE instances |
Full article484 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalAug 17, 2026Vulnerability / DevOps
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data.
The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4.
Released on August 17, 2026, the critical patch release arrived outside the company's usual schedule of twice-monthly updates on the second and fourth Wednesdays, five days after a routine patch release that carried no critical-rated issues.
Only self-managed installations need to act. The fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
"GitLab.com and GitLab Dedicated are already running the patched version. GitLab.com and GitLab Dedicated customers do not need to take action," the company said.
The following versions are affected -
- All versions from 18.2 before 18.11.11
- 19.0 before 19.0.8
- 19.1 before 19.1.6
- 19.2 before 19.2.4
The fixes do not extend to the 18.2 through 18.10 branches, which fall inside the affected range.
"GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive," GitLab said.
The CVSS vector published for the flaw indicates that it can be exploited over a network by an attacker holding no credentials, and without any action on the part of a victim.
GitLab has not named the GraphQL directive involved or specified what the conditions necessary for exploitation are.
The advisory discloses no exploitation of either flaw, and no public exploit code for them has surfaced on GitHub as of August 18, 2026.
The second issue fixed in the release, CVE-2026-19650, has been rated High by GitLab with a CVSS score of 7.1, and concerns a cross-site request forgery (CSRF) weakness in the GraphQL multiplex query handler.
Unlike the critical flaw, it requires user interaction to work.
"GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling," the company said.
The company said the update introduces no new migrations and is not expected to require downtime on multi-node deployments.
The disclosure follows a July 2026 report in which researchers published working exploit code for a separate GitLab flaw affecting self-managed servers.
GitLab did not immediately respond to a request for comment.
The company said it makes the issues detailing each vulnerability public on its issue tracker 90 days after the release that patched them. GitLab's June 10, 2026 patch release put that window at 30 days.
That places technical details of both flaws at around mid-November 2026.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/08/critical-gitlab-graphql-flaw-could-let.html