GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure
Unauthenticated attackers are actively exploiting GitLab CVE-2026-19478 (CVSS 9.4) to modify or delete public projects days after disclosure.
GitLab CVE-2026-19478, a CVSS 9.4 code injection flaw exploitable via a GraphQL directive without authentication, allows attackers to modify or delete publicly accessible projects, rewrite repository data, forge merge records, and ban maintainers. Affected versions include GitLab CE/EE 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. watchTowr reproduced the flaw within minutes of disclosure and observed in-the-wild exploitation against its honeypot network. Fixes shipped in 19.2.4, 19.1.6, 19.0.8, and 18.11.11; interim mitigations include restricting unauthenticated access to /api/graphql or removing public repository access.
- Unauthenticated GraphQL directive abuse lets attackers modify, delete, or rewrite public GitLab projects
- Patched versions: GitLab CE/EE 19.2.4, 19.1.6, 19.0.8, and 18.11.11
- watchTowr honeypots observed in-the-wild exploitation days after public disclosure
- Attackers can forge merge records and ban project maintainers, extending impact beyond project deletion
- Defenders should hunt web logs for requests containing '@gl_introduced' as an exploitation indicator
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-19478 | Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering GitLab has patched a critical (CVSS 9.1) code injection flaw (CWE-94) in how GitLab Community Edition (CE) and Enterprise Edition (EE) process GraphQL directives. Under certain conditions, an unauthenticated remote attacker can abuse a GraphQL directive to modify or delete public projects and user data on affected instances, requiring no privileges or user interaction; the impact is to integrity and availability, not confidentiality. Affected versions span all GitLab CE/EE releases from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4, which covers self-managed installations as well as the same codebase that powers the GitLab.com SaaS. News reports indicate the flaw came under active exploitation within days of disclosure, and EPSS assigns a 5.8% probability of exploitation within 30 days (93rd percentile). It is not yet listed in CISA's KEV catalog and no public proof-of-concept is known, but defenders should treat it as an actively exploited, unauthenticated, high-impact issue. Do: Upgrade all GitLab CE/EE instances to 18.11.11, 19.0.8, 19.1.6, or 19.2.4 (or later) immediately, prioritizing internet-facing instances given confirmed active exploitation. Until patched, restrict unauthenticated access to the GraphQL API endpoint at the network or WAF layer. Review instance audit logs and public projects for signs of unauthorized modifications or deletions of projects and user data. | 9.1 | 6% |
| massmillions of users (GitLab.com SaaS runs the same code) plus tens of thousands of internet-exposed self-managed CE/EE instances |
Full article367 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 21, 2026Vulnerability / Enterprise Security
A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr.
The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions without requiring credentials, user interaction, or obscure configuration.
The following versions of GitLab Community Edition (CE) and Enterprise Edition (EE) are affected by the flaw -
- 18.2 before 18.11.11
- 19.0 before 19.0.8
- 19.1 before 19.1.6
- 19.2 before 19.2.4
In an alert released earlier this week, GitLab said the issue could be exploited via a GraphQL directive. Fixes for the flaw were rolled out in GitLab CE and EE versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
Preemptive exposure management firm watchTowr told The Hacker News that it was able to reproduce the vulnerability within minutes of its disclosure, adding that it observed in-the-wild exploitation against its honeypot network.
"This is the new reality of vulnerability reproduction and exploitation, where AI [artificial intelligence]-enabled attackers are able to compress the time from disclosure to exploitation and 'waiting until the next patch cycle' is often too late," Jake Knott, principal security researcher at watchTowr, said.
"Organizations that haven't patched yet should hunt through web logs for requests containing '@gl_introduced,' and look for signs of probes or attempted exploitation."
watchTowr also noted that the vulnerability's impact goes beyond the ability to modify or delete public projects, adding "an attacker can delete entire repositories, forge merge records to make it appear as if a fix landed when it didn't, and ban project maintainers."
The development once again highlights how AI is rapidly changing the speed and the scale of the attacks, making it crucial that users apply the updates in a timely fashion.
Organizations running internet-facing self-hosted GitLab instances should prioritize upgrading to a patched release. If immediate patching is not possible, it's advised to restrict unauthenticated access to "/api/graphql", or remove public repository access entirely as a mitigation.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/08/gitlab-cve-2026-19478-comes-under.html