GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure
Unauthenticated attackers are actively exploiting GitLab CVE-2026-19478 (CVSS 9.4) to modify or delete public projects days after disclosure.
GitLab CVE-2026-19478, a CVSS 9.4 code injection flaw exploitable via a GraphQL directive without authentication, allows attackers to modify or delete publicly accessible projects, rewrite repository data, forge merge records, and ban maintainers. Affected versions include GitLab CE/EE 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. watchTowr reproduced the flaw within minutes of disclosure and observed in-the-wild exploitation against its honeypot network. Fixes shipped in 19.2.4, 19.1.6, 19.0.8, and 18.11.11; interim mitigations include restricting unauthenticated access to /api/graphql or removing public repository access.
- Unauthenticated GraphQL directive abuse lets attackers modify, delete, or rewrite public GitLab projects
- Patched versions: GitLab CE/EE 19.2.4, 19.1.6, 19.0.8, and 18.11.11
- watchTowr honeypots observed in-the-wild exploitation days after public disclosure
- Attackers can forge merge records and ban project maintainers, extending impact beyond project deletion
- Defenders should hunt web logs for requests containing '@gl_introduced' as an exploitation indicator
- CVEs
- CVE-2026-19478
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19478 | Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering | 9.1 | 6% |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Aug 21, 2026 Vulnerability / Enterprise Security A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-19478 (CVSS score: 9.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.