GitLab Warns of Active Exploitation of Critical GraphQL Flaw
GitLab emergency-patches actively exploited flaw CVE-2026-19478 (CVSS 9.4), letting unauthenticated attackers modify or delete public projects on self-managed servers.
GitLab emergency-patched CVE-2026-19478 (CVSS 9.4) on August 17 after WatchTowr researchers warned of active exploitation. The flaw lets unauthenticated attackers remotely modify or delete public projects and user data through a GraphQL directive, affecting only self-managed installations. Fixes ship in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11; the 18.2-18.10 branches receive no patch and must upgrade. Until patching, defenders should restrict unauthenticated access to /api/graphql, disable public repositories, and hunt for @gl_introduced in logs.
- Unauthenticated attackers can remotely modify or delete public projects and user data via a GraphQL directive
- Emergency patch shipped August 17 in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11
- Only self-managed installs affected; 18.2-18.10 branches get no fix and require upgrade
- Interim mitigations: restrict /api/graphql, disable public repos, audit logs for @gl_introduced
- CVEs
- CVE-2026-19478
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19478 | Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering | 9.1 | 6% |
From the original article
1 min read at securityaffairs.com
GitLab flaw CVE-2026-19478 is now under active exploitation, allowing unauthenticated attackers to modify or delete public projects. WatchTowr researchers warn of active exploitation of critical GitLab flaw CVE-2026-19478 (CVSS score of 9. 4).
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.