CVE Tools
Track your stack

Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)

Help Net SecurityBy Sinisa Markovic

PatchGitLab CE/EE

Our summary

GitLab has deployed urgent fixes for two security issues affecting Community Edition and Enterprise Edition versions prior to specific release thresholds. The primary concern is a critical vulnerability identified as CVE-2026-19478">CVE-2026-19478, which enables unauthenticated remote attackers to execute code via a GraphQL directive, potentially compromising public project integrity and user data. A secondary high-severity flaw, CVE-2026-19650">CVE-2026-19650, involves cross-site request forgery risks within the GraphQL multiplex query handler.

Self-managed instances must be updated immediately to versions 18.11.11, 19.0.8, 19.1.6, or 19.2.4 to mitigate these risks, while hosted GitLab.com and Dedicated environments are already protected.

Read at Help Net Security

Help Net Security publishes this story on its own site; we link to it rather than reprint it.

  1. Хакер (xakep.ru)Критическая уязвимость в GitLab позволяла удалять общедоступные проектыCVE-2026-19478, CVE-2026-19650
  2. Dark ReadingCritical GitLab Zero-Click Flaw Poses Mitigation ChallengesCVE-2026-19478, CVE-2026-19650
  3. OX SecurityCritical and High-Severity GraphQL CVEs in GitLab: Code Injection and CSRF via One DirectiveCVE-2026-19478, CVE-2026-19650
  4. SecurityWeekGitLab Patches Critical Code Injection VulnerabilityCVE-2026-19478, CVE-2026-19650
  5. The Hacker NewsCritical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public ProjectsCVE-2026-19478, CVE-2026-19650
  6. Dark ReadingMaximum Severity GitLab Flaw Puts Supply Chains at RiskCVE-2026-19478
  7. The Hacker NewsGitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After DisclosureCVE-2026-19478
  8. Хакер (xakep.ru)Критический баг в GitLab уже взяли на вооружение хакерыCVE-2026-19478
  9. The Hacker News⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and MoreCVE-2026-19478
  10. Check Point Research24th August – Threat Intelligence ReportCVE-2026-19478

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store