GitLab Warns of Active Exploitation of Critical GraphQL Flaw
GitLab emergency-patches actively exploited flaw CVE-2026-19478 (CVSS 9.4), letting unauthenticated attackers modify or delete public projects on self-managed servers.
GitLab emergency-patched CVE-2026-19478 (CVSS 9.4) on August 17 after WatchTowr researchers warned of active exploitation. The flaw lets unauthenticated attackers remotely modify or delete public projects and user data through a GraphQL directive, affecting only self-managed installations. Fixes ship in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11; the 18.2-18.10 branches receive no patch and must upgrade. Until patching, defenders should restrict unauthenticated access to /api/graphql, disable public repositories, and hunt for @gl_introduced in logs.
- Unauthenticated attackers can remotely modify or delete public projects and user data via a GraphQL directive
- Emergency patch shipped August 17 in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11
- Only self-managed installs affected; 18.2-18.10 branches get no fix and require upgrade
- Interim mitigations: restrict /api/graphql, disable public repos, audit logs for @gl_introduced
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-19478 | Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering GitLab has patched a critical (CVSS 9.1) code injection flaw (CWE-94) in how GitLab Community Edition (CE) and Enterprise Edition (EE) process GraphQL directives. Under certain conditions, an unauthenticated remote attacker can abuse a GraphQL directive to modify or delete public projects and user data on affected instances, requiring no privileges or user interaction; the impact is to integrity and availability, not confidentiality. Affected versions span all GitLab CE/EE releases from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4, which covers self-managed installations as well as the same codebase that powers the GitLab.com SaaS. News reports indicate the flaw came under active exploitation within days of disclosure, and EPSS assigns a 5.8% probability of exploitation within 30 days (93rd percentile). It is not yet listed in CISA's KEV catalog and no public proof-of-concept is known, but defenders should treat it as an actively exploited, unauthenticated, high-impact issue. Do: Upgrade all GitLab CE/EE instances to 18.11.11, 19.0.8, 19.1.6, or 19.2.4 (or later) immediately, prioritizing internet-facing instances given confirmed active exploitation. Until patched, restrict unauthenticated access to the GraphQL API endpoint at the network or WAF layer. Review instance audit logs and public projects for signs of unauthorized modifications or deletions of projects and user data. | 9.1 | 6% |
| massmillions of users (GitLab.com SaaS runs the same code) plus tens of thousands of internet-exposed self-managed CE/EE instances |
Full article251 words · extracted from securityaffairs.com · click to collapse
GitLab flaw CVE-2026-19478 is now under active exploitation, allowing unauthenticated attackers to modify or delete public projects.
WatchTowr researchers warn of active exploitation of critical GitLab flaw CVE-2026-19478 (CVSS score of 9.4). This week, GitLab pushed out an emergency patch to address this flaw, which could let an attacker with zero credentials remotely modify or delete public projects and user data.
“GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.” reads the advisory.
GitLab issued an emergency patch on August 17, five days after its regular update. The vulnerability impacts only self-managed installations, users should upgrade to versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
There’s a gap worth flagging for anyone still sitting on an older release. The available patches don’t cover the 18.2 through 18.10 branches, even though those versions technically fall inside the affected range. If you’re running anything in that window, staying put isn’t really an option; you’ll need to upgrade to a patched branch entirely rather than waiting for a fix that isn’t coming for your current one.
hiimguardian reported the flaw through the company HackerOne bug bounty program.
Organizations should urgently patch internet-facing GitLab servers. Until they can update, they should restrict unauthenticated access to /api/graphql, disable public repositories where possible, and check logs for requests containing @gl_introduced.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2026-19478)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/197622/hacking/gitlab-warns-of-active-exploitation-of-critical-graphql-flaw.html