GitLab CVE-2026-19478 is a critical, unauthenticated code-injection flaw in the GraphQL API of self-managed GitLab Community and Enterprise Edition that lets a remote attacker modify or delete public projects and user data without any credentials. It carries a CVSS score of 9.4, is categorized as CWE-94 (improper control of code generation), and was fixed in an out-of-band release on August 17, 2026. GitLab.com was patched before disclosure; every self-managed instance on an affected version needs to upgrade now.

The flaw lives in how GitLab handled custom GraphQL directives. Under certain conditions, unresolved directive input was dispatched dynamically against server-side objects, letting an unauthenticated caller invoke state-changing methods through an ordinary POST to /api/graphql. No session token, no cookie, no CSRF prerequisite. The same release also fixed CVE-2026-19650, a CVSS 7.1 flaw that allowed GraphQL mutations via GET requests due to improper multiplex query validation. Both were reported through GitLab's HackerOne program.

What makes this more than a defacement risk is the supply-chain angle. Silently altering or deleting a public repository is a way to stage a downstream compromise: hijack the projects that CI/CD pipelines and package consumers depend on, and the blast radius extends well beyond the GitLab server itself. That is why the security community expected weaponization fast, since the payload is a single unauthenticated HTTP request that automated scanners can spray across every internet-facing instance.

Which GitLab versions are affected and fixed?

The vulnerability affects self-managed CE and EE across four release trains. Upgrade to the patched build on your branch immediately; if you run an older, unsupported branch, follow GitLab's upgrade-path tool to step through the required intermediate versions.

At disclosure there was no confirmed in-the-wild exploitation, but mass scanning of exposed instances on Shodan and Censys began immediately after the patch shipped, and the patch diff is small enough to reverse-engineer quickly.

What can defenders do if they cannot patch immediately?

The primary fix is the upgrade; treat everything else as a stopgap. If a maintenance window is not available, restrict unauthenticated access to /api/graphql at your reverse proxy or WAF, or limit the endpoint to trusted internal ranges, accepting that this can affect front-end functionality. Temporarily reducing instance and project visibility shrinks the unauthenticated attack surface. For detection, inspect production_json.log and api_json.log for unauthenticated POST requests to /api/graphql with abnormal execution times or unknown directive syntax, and review audit logs for unexpected deletions or changes to public projects.

Our read

An unauthenticated path from the public internet to object mutation is the kind of finding that a point-in-time scan reports as "informational" right up until someone deletes a repository. GitLab sits at the center of the software supply chain, so the honest question is not "is our instance patched" but "can we prove no one probed /api/graphql before we patched, and that nothing was altered." That is a supervised-adversary and compliance-as-evidence problem: exercise the exact unauthenticated request an attacker would send, keep the logs that show what happened, and you convert a scary CVSS 9.4 into a controlled, verifiable exposure.

Reporting by SecurityWeek; CVSS and affected-version data per NVD and GitLab's advisory. Sources linked above.

Related: GhostSplice and malicious MCP servers and the LiteLLM PyPI supply-chain incident.