GitLab GraphQL Flaw

Overview

On August 17, 2026, GitLab released an out‑of‑band security update to fix a critical GraphQL vulnerability (CVE‑2026‑19478) impacting both Community Edition (CE) and Enterprise Edition (EE). Rated Critical (CVSS 9.4), the flaw could allow unauthenticated attackers to remotely modify or delete public projects and user data under certain conditions.

Vulnerability Details

• CVE‑2026‑19478: Exploitable over a network, requiring no credentials and no victim interaction.
• Attack vector: A GraphQL directive that, under specific conditions, enables unauthorized mutations.
• Impact: Remote modification or deletion of public projects and user data.
• Patch release: GitLab issued fixes outside its normal twice‑monthly schedule due to the severity.

Affected Versions

• 18.2 → before 18.11.11
• 19.0 → before 19.0.8
• 19.1 → before 19.1.6
• 19.2 → before 19.2.4

GitLab.com and GitLab Dedicated are already patched. Only self‑managed installations need to apply updates.

Additional Issue Fixed

• CVE‑2026‑19650: A High‑severity CSRF vulnerability (CVSS 7.1) in the GraphQL multiplex query handler.
• Impact: Could allow unauthenticated users to execute mutations via GET requests.
• Requirement: User interaction is necessary for exploitation.

Defensive Guidance

Organizations running self‑managed GitLab should:

• Update immediately: Apply fixes in versions 19.2.4, 19.1.6, 19.0.8, or 18.11.11.
• Audit public projects: Check for unauthorized modifications or deletions.
• Monitor GraphQL activity: Look for unusual mutations or GET requests.
• Prepare for disclosure: Technical details will be made public around mid‑November 2026.

Expert in the Cloud Insight

This flaw underscores the growing attack surface of GraphQL APIs in modern DevOps platforms. Because CVE‑2026‑19478 requires no credentials or victim interaction, it represents one of the most dangerous classes of vulnerabilities—unauthenticated remote modification. Enterprises relying on self‑managed GitLab must treat this patch as urgent, ensuring updates are applied before attackers weaponize the flaw.