GitLab Patches Critical Code Injection Vulnerability
GitLab patched a critical code injection vulnerability (CVE-2026-19478) that allowed unauthenticated attackers to modify or delete user data and public projects via a GraphQL directive. The vulnerability affected multiple GitLab Community and Enterprise Edition versions starting from 18.2, 19.0, 19.1, and 19.2 onwards. A second related CSRF vulnerability (CVE-2026-19650) was also fixed. The patches have been released and automatically applied to GitLab.com and GitLab Dedicated, requiring immediate upgrades for self-managed instances.
AI Analysis
Technical Summary
GitLab addressed a critical unauthenticated code injection vulnerability tracked as CVE-2026-19478 with a CVSS score of 9.4. This flaw allowed attackers to execute mutations via GET requests due to improper request validation in the GraphQL multiplex query handler, enabling modification or deletion of user data and public projects. Additionally, a CSRF vulnerability (CVE-2026-19650, CVSS 7.1) affecting the GraphQL multiplex query handler was patched. The vulnerabilities impacted all GitLab CE and EE versions from 18.2, 19.0, 19.1, and 19.2 onwards and were fixed in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4. The vendor has applied patches automatically to their cloud services, and no exploitation in the wild has been reported.
Potential Impact
Successful exploitation of CVE-2026-19478 allows unauthenticated attackers to modify or delete user data and public projects, potentially leading to data loss and disruption of project integrity. The CSRF vulnerability (CVE-2026-19650) could allow unauthorized actions via forged requests. No known active exploitation has been reported.
Mitigation Recommendations
GitLab has released official patches for the vulnerabilities in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4. Users of self-managed GitLab instances should upgrade immediately to one of these versions. Cloud-hosted GitLab services (GitLab.com and GitLab Dedicated) have been automatically patched, requiring no action from their users.
GitLab Patches Critical Code Injection Vulnerability
Description
GitLab patched a critical code injection vulnerability (CVE-2026-19478) that allowed unauthenticated attackers to modify or delete user data and public projects via a GraphQL directive. The vulnerability affected multiple GitLab Community and Enterprise Edition versions starting from 18.2, 19.0, 19.1, and 19.2 onwards. A second related CSRF vulnerability (CVE-2026-19650) was also fixed. The patches have been released and automatically applied to GitLab.com and GitLab Dedicated, requiring immediate upgrades for self-managed instances.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
GitLab addressed a critical unauthenticated code injection vulnerability tracked as CVE-2026-19478 with a CVSS score of 9.4. This flaw allowed attackers to execute mutations via GET requests due to improper request validation in the GraphQL multiplex query handler, enabling modification or deletion of user data and public projects. Additionally, a CSRF vulnerability (CVE-2026-19650, CVSS 7.1) affecting the GraphQL multiplex query handler was patched. The vulnerabilities impacted all GitLab CE and EE versions from 18.2, 19.0, 19.1, and 19.2 onwards and were fixed in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4. The vendor has applied patches automatically to their cloud services, and no exploitation in the wild has been reported.
Potential Impact
Successful exploitation of CVE-2026-19478 allows unauthenticated attackers to modify or delete user data and public projects, potentially leading to data loss and disruption of project integrity. The CSRF vulnerability (CVE-2026-19650) could allow unauthorized actions via forged requests. No known active exploitation has been reported.
Mitigation Recommendations
GitLab has released official patches for the vulnerabilities in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4. Users of self-managed GitLab instances should upgrade immediately to one of these versions. Cloud-hosted GitLab services (GitLab.com and GitLab Dedicated) have been automatically patched, requiring no action from their users.
Technical Details
- Classification
- {"confidence":0.95,"severitySource":"heuristic","classifier":"rss-v2"}
- Article Source
- {"url":"https://www.securityweek.com/gitlab-patches-critical-code-injection-vulnerability/","fetched":true,"fetchedAt":"2026-08-18T08:56:13.858Z","wordCount":909}
Threat ID: 6a841e2dbf8831d5397e360b
Added to database: 08/18/2026, 08:56:13 UTC
Last enriched: 08/18/2026, 08:56:25 UTC
Last updated: 08/18/2026, 10:03:39 UTC
Views: 28
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.