GitLab Patches Critical Vulnerability Allowing Unauthenticated Data Tampering
GitLab released emergency security updates on August 17, 2026, addressing a critical vulnerability (CVE-2026-19478) that could enable unauthenticated attackers to remotely modify or delete public projects and user data. The flaw, rated 9.4 on the CVSS scale, affects GitLab Community Edition (CE) and Enterprise Edition (EE) across multiple versions, including 18.2–18.11.11, 19.0.0–19.0.8, 19.1.0–19.1.6, and 19.2.0–19.2.4.
The issue stems from a code injection vulnerability in a GraphQL directive, allowing remote exploitation without credentials or user interaction. Organizations with internet-facing GitLab instances, public repositories, or exposed GraphQL services are at heightened risk, as attackers could disrupt development workflows, tamper with source code, or compromise downstream supply chains.
GitLab also patched a second, high-severity flaw (CVE-2026-19650, CVSS 7.1), a CSRF vulnerability in the GraphQL multiplex query handler. This could allow unauthenticated users to execute unauthorized state-changing operations via crafted GET requests, though exploitation requires user interaction.
Patched versions (19.2.4, 19.1.6, 19.0.8, and 18.11.11) were released outside GitLab’s standard update cycle. GitLab Dedicated customers are unaffected, as their hosted instances were automatically updated. Self-managed administrators are advised to apply fixes immediately, noting that Omnibus packages may trigger service restarts unless configured for zero-downtime upgrades.
The vulnerabilities underscore risks in GraphQL request handling, particularly when exposed interfaces permit sensitive actions. Organizations are encouraged to review audit logs for suspicious activity, verify backups, and ensure proper access controls.
Source: https://cyberpress.org/gitlab-critical-vulnerability/
GitLab TPRM report: https://www.rankiteo.com/company/gitlab-com
"id": "git1787036383",
"linkid": "gitlab-com",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Organizations with '
'internet-facing GitLab '
'instances, public repositories, '
'or exposed GraphQL services',
'industry': 'Technology',
'name': 'GitLab',
'type': 'Software Provider'}],
'attack_vector': ['Remote Exploitation', 'Unauthenticated Access'],
'customer_advisories': 'Self-managed administrators are advised to apply '
'fixes immediately. GitLab Dedicated customers are '
'unaffected as their hosted instances were '
'automatically updated.',
'data_breach': {'type_of_data_compromised': ['Public projects', 'User data']},
'date_publicly_disclosed': '2026-08-17',
'date_resolved': '2026-08-17',
'description': 'GitLab released emergency security updates addressing a '
'critical vulnerability (CVE-2026-19478) that could enable '
'unauthenticated attackers to remotely modify or delete public '
'projects and user data. The flaw affects GitLab Community '
'Edition (CE) and Enterprise Edition (EE) across multiple '
'versions. A second high-severity flaw (CVE-2026-19650) was '
'also patched, involving a CSRF vulnerability in the GraphQL '
'multiplex query handler.',
'impact': {'data_compromised': ['Public projects', 'User data'],
'operational_impact': ['Disruption of development workflows',
'Tampering with source code',
'Compromise of downstream supply chains'],
'systems_affected': ['GitLab Community Edition (CE)',
'GitLab Enterprise Edition (EE)']},
'lessons_learned': 'The vulnerabilities underscore risks in GraphQL request '
'handling, particularly when exposed interfaces permit '
'sensitive actions.',
'post_incident_analysis': {'corrective_actions': ['Patches released for '
'affected versions',
'Automatic updates for '
'GitLab Dedicated '
'customers'],
'root_causes': ['Code injection vulnerability in a '
'GraphQL directive',
'CSRF vulnerability in the GraphQL '
'multiplex query handler']},
'recommendations': ['Apply patches immediately',
'Review audit logs for suspicious activity',
'Verify backups',
'Ensure proper access controls'],
'references': [{'source': 'GitLab Security Advisory'}],
'response': {'communication_strategy': ['Public disclosure of vulnerabilities',
'Advisory to self-managed '
'administrators'],
'containment_measures': ['Emergency security updates released'],
'enhanced_monitoring': ['Review audit logs for suspicious '
'activity'],
'remediation_measures': ['Patches applied (versions 19.2.4, '
'19.1.6, 19.0.8, 18.11.11)']},
'title': 'GitLab Patches Critical Vulnerability Allowing Unauthenticated Data '
'Tampering',
'type': ['Code Injection', 'CSRF'],
'vulnerability_exploited': ['CVE-2026-19478', 'CVE-2026-19650']}