Do Son 
TL;DR
GitLab shipped an out-of-band critical patch on August 17, 2026. It fixes CVE-2026-19478, a GraphQL code injection flaw rated CVSS 9.4. Under certain conditions, an unauthenticated attacker could modify or delete public projects and user data. A second flaw, CVE-2026-19650, is a CSRF issue rated CVSS 7.1. No exploitation has been reported.
- Product: GitLab
- Vulnerabilities: 2 flaws (CVE-2026-19478, CVE-2026-19650)
- Highest severity: 9.4 (Critical · CVSSv3)
- Worst impact: Improper Control of Generation of Code ('Code Injection') in
- Status: No confirmed exploitation yet; patches available
- Action: Update to 18.11.11, 19.0.8, 19.1.6, 19.2.4 now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-19478 | 9.4 | CWE-94 | 18.11.11, 19.0.8, 19.1.6 (+1) | Not exploited |
| CVE-2026-19650 | 7.1 | CWE-352 | 18.11.11, 19.0.8, 19.1.6 (+1) | Not exploited |
Why It Matters
GitLab hosts source code for countless organizations. This CVE-2026-19478 code injection flaw needs no login to abuse. As a result, an attacker could tamper with or destroy public project data.
The patch arrived off GitLab’s normal schedule, which signals urgency. Notably, it landed just five days after a routine release that carried no critical fixes. Only self-managed installations need to act, since GitLab.com and Dedicated already run the fix.
How the Attack Works
Both flaws sit in GitLab’s GraphQL API. The critical bug involves a GraphQL directive. Under certain conditions, that directive allowed an unauthenticated user to reach data-changing actions.
The second issue, CVE-2026-19650, is a cross-site request forgery flaw. It stems from improper request validation in the GraphQL multiplex query handler. Because of that gap, an attacker could trigger mutations through GET requests. That behavior needs user interaction, unlike the critical code injection flaw. This report describes the mechanism only and includes no exploit code.
Affected Versions
Both flaws affect GitLab CE and EE. The impacted range covers all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.
Researchers “hiimguardian” and “kreep” reported the two flaws through GitLab’s HackerOne bug bounty program.
Patch and Mitigation Steps
Upgrade to GitLab 19.2.4, 19.1.6, 19.0.8, or 18.11.11 as soon as possible. The official GitLab critical patch release lists the details for each fixed branch.
These versions add no new migrations, so multi-node deployments should avoid downtime. Self-managed admins should prioritize this update given the CVSS 9.4 rating. GitLab.com and Dedicated customers need no action.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
