The critical vulnerability of GitLab did not have time to stay public and two days before it began to be used in real attacks. The problem of CVE-2026-19478 (9.7 Critical) allows you to change and delete publicly available projects and user data without an account, and after the demo code appeared in the network, the attacks are noticeably easier.
GitLab fixed CVE-2026-19478 on August 17 in emergency versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11 for Community Edition and Enterprise Edition. The company estimated the vulnerability risk of 9.4 out of 10 on the CVSS scale. No accounts or any actions by the user are required for the attack.
The error is related to how GraphQL directives are processed. Under certain conditions, a specially formed request allows a remote user to interfere with the work of GitLab and perform operations that in a normal situation require appropriate rights. As a result, the attacker can modify or delete publicly available projects and user-related data.
GitLab CE and EE are at risk since branch 18.2. Vulnerable versions until 18.11.11, branch 19.0 to 19.0.8, 19.1 to 19.1.6 and 19.2 to 19.2.4. Cloud GitLab.com and the GitLab Dedicated service have already received a fix, so you need to update first of all the owners of self-deployed servers.
The situation deteriorated rapidly after the error was published. Demonstration programs for CVE-2026-19478 appeared in the public domain, and on August 19, the Italian computer incident response team reported that the vulnerability was trying to exploit. Thus, only two days passed between the way the correction was released and how the signs of real attacks appeared.
The danger of CVE-2026-19478 is not limited to the fact that files may be lost. Publicly available GitLab projects may store source code, build settings, automation scenarios, and other data that, if modified, can affect further program development. If the projects are deleted, the organization also risks losing data – if it does not have up-to-date backups.
In the same emergency issue, GitLab closed CVE-2026-19650 (7.1 High). The error in the GraphQL composite request handler allowed these changes through GET requests due to the fact that the request was not sufficiently checked. Unlike CVE-2026-19478, a user action is required to exploit a second vulnerability.
GitLab strongly recommends that owners of vulnerable servers immediately switch to the up-to-date corrected version of their branch. Given the already recorded attempts to operate, it is particularly risky to delay in order to update publicly available servers.
GitLab fixed CVE-2026-19478 on August 17 in emergency versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11 for Community Edition and Enterprise Edition. The company estimated the vulnerability risk of 9.4 out of 10 on the CVSS scale. No accounts or any actions by the user are required for the attack.
The error is related to how GraphQL directives are processed. Under certain conditions, a specially formed request allows a remote user to interfere with the work of GitLab and perform operations that in a normal situation require appropriate rights. As a result, the attacker can modify or delete publicly available projects and user-related data.
GitLab CE and EE are at risk since branch 18.2. Vulnerable versions until 18.11.11, branch 19.0 to 19.0.8, 19.1 to 19.1.6 and 19.2 to 19.2.4. Cloud GitLab.com and the GitLab Dedicated service have already received a fix, so you need to update first of all the owners of self-deployed servers.
The situation deteriorated rapidly after the error was published. Demonstration programs for CVE-2026-19478 appeared in the public domain, and on August 19, the Italian computer incident response team reported that the vulnerability was trying to exploit. Thus, only two days passed between the way the correction was released and how the signs of real attacks appeared.
The danger of CVE-2026-19478 is not limited to the fact that files may be lost. Publicly available GitLab projects may store source code, build settings, automation scenarios, and other data that, if modified, can affect further program development. If the projects are deleted, the organization also risks losing data – if it does not have up-to-date backups.
In the same emergency issue, GitLab closed CVE-2026-19650 (7.1 High). The error in the GraphQL composite request handler allowed these changes through GET requests due to the fact that the request was not sufficiently checked. Unlike CVE-2026-19478, a user action is required to exploit a second vulnerability.
GitLab strongly recommends that owners of vulnerable servers immediately switch to the up-to-date corrected version of their branch. Given the already recorded attempts to operate, it is particularly risky to delay in order to update publicly available servers.
CC
CC
CC
CC
CC
CC
