GitLab released a critical patch on 17 August 2026 covering versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. The release fixes two vulnerabilities in the GraphQL subsystem. CVE-2026-19478, rated CVSS 9.4, allows an unauthenticated attacker to modify or delete public projects and user data via a GraphQL directive. CVE-2026-19650, rated CVSS 7.1, is a cross-site request forgery in the GraphQL multiplex query handler.

Vulnerability Details

GitLab describes CVE-2026-19478 as an issue that "could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive," and classifies it internally as a code injection issue. Fuller technical detail, including the affected directive and the fix commit, follows GitLab's standard disclosure timeline.

The CVSS vector rates confidentiality impact as Low, with integrity and availability both rated High. The primary exposure is to the integrity and availability of public projects and user data. The 9.4 score derives from combining an unauthenticated network attack vector, low attack complexity, and no user interaction with high integrity and availability impact.

CVE-2026-19650 originates in the GraphQL multiplex query handler, where request validation permitted mutations to execute over HTTP GET. The multiplex endpoint batches multiple operations into a single request, and validation of those batches allowed state-changing operations to be issued by GET. Since GET requests are triggered by image tags, links in issue and merge request descriptions, external redirects, and browser prefetching, an authenticated user loading attacker-controlled content could have mutations executed under their session. This dependency on an authenticated victim accounts for the UI:R rating.

The two vulnerabilities were reported independently by different researchers, are independently exploitable, and shipped in the same release because both affect the GraphQL subsystem. A single upgrade remediates both.

Affected and Fixed Versions

Version 18.11.11 is the designated fix release for the entire 18.x line, so instances running 18.2 through 18.10 upgrade forward to 18.11.11. Some coverage of this release describes the 18.x line differently, and some lists 19.0.6 in place of 19.0.8; the vendor advisory confirms the versions in the table above.

GitLab.com and GitLab Dedicated were patched prior to public disclosure and are already remediated. Self-managed CE and EE installations within the affected ranges require an upgrade.

Upgrade Notes

• Database migrations: The release applies without introducing new database migrations.

• Multi-node deployments: Zero-downtime upgrades are supported.

• Omnibus packages: These stop the instance, run migrations, and restart by default, unless a skip file is configured.

Mitigation

Upgrading is the vendor-supported remediation for both vulnerabilities. Interim options and their scope follow.

• Retain the GraphQL endpoint: The GitLab web interface operates on /api/graphql, so the endpoint stays in place during remediation.

• Restrict network access: CVE-2026-19478 depends on network reachability with no privileges, so placing internet-facing instances behind a VPN or IP allowlist closes the attack path until the upgrade is applied. This is the most effective interim control for the critical flaw.

• Filter GET-borne mutations at the WAF: Blocking GraphQL mutations delivered over HTTP GET addresses CVE-2026-19650 with low false-positive risk, since legitimate GitLab clients issue mutations over POST. CVE-2026-19478 is covered by upgrading or network restriction.

• Signature accuracy for CVE-2026-19478 improves after disclosure: GitLab releases the directive and payload structure on its disclosure timeline. Schedule WAF signature development for this flaw around that release, and rely on upgrading and network restriction in the interim.

Detection

The checks below support investigation of potential exploitation activity. GitLab is expected to publish indicators of compromise with the full technical disclosure.

• GraphQL request logs: Review production_json.log and api_json.log for unauthenticated requests to /api/graphql, requests containing directives, and GET requests reaching the multiplex endpoint.

• Project and namespace deletion events: Deletion or modification of public projects is the expected artefact of the integrity and availability impact. This is the highest-value check, and covers the full exposure window.

• Public project and user record changes: Correlate modifications to public project metadata and user records against known legitimate activity.

The exposure window runs from the first affected release in a given branch through to the date of patching. Since 18.2 is the earliest affected version, this window is extensive for long-running installations. Prioritise the deletion audit accordingly.

Exploitation Status

As of 18 August 2026, both vulnerabilities remain unexploited according to public reporting, proof-of-concept code remains unpublished, and the CISA Known Exploited Vulnerabilities catalog lists neither CVE.

GitLab holds the originating HackerOne reports confidential for approximately 30 days following a fix, and typically releases fuller technical detail around 90 days, placing expected disclosure near mid-November 2026. The patched releases are publicly available, so technical detail is derivable through source comparison ahead of that date. Upgrade promptly.

Recommended Actions

• Identify all self-managed instances: Include deployments recorded outside the primary asset inventory.

• Verify running versions against the table above, noting that 18.2 through 18.10 upgrade forward to 18.11.11.

• Upgrade to 19.2.4, 19.1.6, 19.0.8, or 18.11.11: The release applies without new database migrations and supports zero-downtime upgrades.

• Restrict network access where upgrades are scheduled for later: Move internet-facing instances behind a VPN or IP allowlist in the interim.

• Collect deletion and modification logs before upgrading to preserve evidence covering the exposure window.

• Review internal GraphQL implementations to confirm mutations are restricted to POST.