GitLab has issued an urgent security update to resolve a critical GraphQL vulnerability that enables attackers to remotely alter or delete public projects and user data without authentication.
This vulnerability, identified as CVE-2026-19478, affects both GitLab Community Edition and Enterprise Edition across several release branches. The issue was addressed in GitLab versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, released on August 17, 2026.
Understanding the GitLab Vulnerability
CVE-2026-19478 is a code injection flaw in a GraphQL directive, exploitable by unauthenticated remote attackers under specific conditions. This could result in unauthorized modifications or deletions of public GitLab resources.
The vulnerability has been assigned a CVSS score of 9.4, categorizing it as critical due to its potential to disrupt integrity and availability with minimal attack complexity and no prerequisite privileges.
Impact and Mitigation
Affected versions include all GitLab CE and EE releases from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. Organizations using these versions should prioritize patching, especially if public projects are enabled.
GitLab has already implemented the fix on GitLab.com and GitLab Dedicated, requiring no further action from users. Administrators of self-managed instances are strongly advised to upgrade immediately to ensure protection.
Additional Security Concerns
The update also addresses CVE-2026-19650, a high-severity cross-site request forgery vulnerability in the GraphQL multiplex query handler, which could allow unauthorized GraphQL mutations through improperly validated GET requests. This flaw carries a CVSS score of 7.1.
Security teams are encouraged to upgrade to the latest GitLab versions to mitigate these vulnerabilities. No new database migrations are needed, and multi-node deployments should not require significant downtime.
Regularly reviewing GitLab audit logs for unusual activities, such as unexpected changes to public repositories or suspicious GraphQL actions, is recommended to ensure security. Internet-facing instances should be prioritized due to the remote exploitability of the vulnerability.
This incident underscores the importance of timely updates in maintaining the security and integrity of software development environments.
