Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab disclosed CVE-2026-19478, a critical (CVSS 9.4) unauthenticated vulnerability allowing remote modification or deletion of public projects and user data via a GraphQL directive An out-of-band patch was released on August 17, 2026, with fixes in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11 A secondary high-severity CVE-2026-19650 (CVSS 7.1) addresses a CSRF flaw in the GraphQL multiplex query handler that permits mutations via GET requests GitLab.com and GitLab Dedicated are already patche
Analysis
TL;DR
- GitLab disclosed CVE-2026-19478, a critical (CVSS 9.4) unauthenticated vulnerability allowing remote modification or deletion of public projects and user data via a GraphQL directive
- An out-of-band patch was released on August 17, 2026, with fixes in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11
- A secondary high-severity CVE-2026-19650 (CVSS 7.1) addresses a CSRF flaw in the GraphQL multiplex query handler that permits mutations via GET requests
- GitLab.com and GitLab Dedicated are already patched; only self-managed installations require action
- Full technical details are expected around mid-November 2026, 90 days after the patch release
Why It Matters
This vulnerability highlights the growing attack surface posed by GraphQL APIs in widely adopted DevOps platforms, where unauthenticated exploitation can lead to destructive outcomes like public project deletion. For AI practitioners and DevOps teams relying on GitLab for CI/CD pipelines and code hosting, the flaw poses direct operational and data integrity risks, especially for self-managed deployments that remain exposed until patched.
Technical Details
- CVE-2026-19478 (Critical, CVSS 9.4): An unauthenticated attacker can remotely modify or delete public projects and user data through a specific GraphQL directive. The exploit requires no credentials and no victim interaction, making it a network-level, zero-touch attack vector.
- CVE-2026-19650 (High, CVSS 7.1): A CSRF vulnerability in the GraphQL multiplex query handler allows unauthenticated execution of mutations via GET requests due to improper request validation, though it requires user interaction to exploit.
- Affected versions: All self-managed GitLab installations from 18.2 up to (but not including) 18.11.11, 19.0.8, 19.1.6, and 19.2.4. Versions 18.2–18.10 are affected but have no available fix.
- Patch details: No new database migrations are introduced, and the update is not expected to require downtime on multi-node deployments.
- Disclosure timeline: GitLab plans to publish full issue details on its tracker 90 days post-patch, placing technical specifics around mid-November 2026.
Industry Insight
- Organizations running self-managed GitLab instances should prioritize immediate patching, as the unauthenticated nature of CVE-2026-19478 makes it trivially exploitable at scale with no victim interaction required.
- The recurrence of critical GraphQL-related vulnerabilities in GitLab underscores the need for stricter input validation and authentication enforcement on GraphQL endpoints across DevOps tooling.
- Teams should monitor for public exploit code release and consider network-level mitigations (e.g., WAF rules blocking suspicious GraphQL mutations) until patches are applied, especially given the absence of known exploitation as of August 18, 2026.
Disclaimer: The above content is generated by AI and is for reference only.