CVE-2026-19478 — GitLab ships an out-of-band critical patch for a GraphQL directive flaw that lets an unauthenticated caller modify or delete public projects and user data (CVSS 9.4)
GitLab published an ad-hoc critical patch release on 2026-08-17 — versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11 for both Community and Enterprise Edition — outside the twice-monthly scheduled cadence it reserves for routine security fixes (GitLab, 2026-08-17). The flaw that earned the out-of-band release is CVE-2026-19478, which GitLab titles a code-injection issue via GraphQL directive and describes as an issue that "under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive" (GitLab, 2026-08-17). France's CERT-FR republished the advisory to its own constituency the following day (CERT-FR, 2026-08-18).
The reason this clears the bar for out-of-band attention rather than the next patch window is the shape of GitLab's own score, not a severity headline. The vendor's vector for CVE-2026-19478 is network-reachable, low-complexity, no privileges required and no user interaction, with low confidentiality impact but high integrity and high availability impact — a flaw whose demonstrated consequence is destroying or altering data rather than reading it. That inverts the usual triage instinct on a source-control platform, where the reflex is to reason about code theft: the loss scenario here is projects and user records being modified or deleted by an unauthenticated caller, which is a restore-from-backup event rather than a disclosure event. Affected versions run from 18.2 up to the four fixed releases — every release line from 18.2 onward, which is a little over a year of releases — and GitLab.com and GitLab Dedicated were already running patched code at disclosure, so the entire exposed population is self-managed instances.
The companion flaw, CVE-2026-19650 at CVSS 7.1, is a cross-site request forgery weakness in the GraphQL multiplex query handler that GitLab states "could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling" (GitLab, 2026-08-17). Its vector requires user interaction, so it needs an authenticated victim to be induced into loading a request — a different exploitation model from the first flaw and a lower one, but it lands on the same fixed releases. Both were reported through GitLab's HackerOne programme, credited to the researchers hiimguardian and kreep respectively.
No party reports exploitation, and there is no public proof-of-concept. There is also, deliberately, no published mechanism: GitLab's policy is that "the issues detailing each vulnerability are made public on our" issue tracker 90 days after the patch release (GitLab, 2026-08-17), so nothing beyond the vendor's one-sentence descriptions exists to reason from and this entry makes no root-cause claim. That withholding is what makes the patch the whole of the response — there is no interim configuration control to fall back on, because nobody outside GitLab knows which directive or which validation path is at fault.
Detection is thin by construction and hunting should not pretend otherwise. What a self-managed operator can do is bound the exposure: GraphQL traffic to /api/graphql from unauthenticated sources is the reachable surface, and in web and application access logs the durable signals are unauthenticated POST or GET requests to that endpoint, and — for the destruction impact specifically — project or user deletion and modification events in GitLab's own audit records that do not correlate with an authenticated session or a known administrator action. Triage: GraphQL is how GitLab's own web UI and integrations talk to the server, so request volume to that endpoint is uninformative on its own; the discriminator is a state-changing outcome (a deleted or altered project, a modified user record) appearing in the audit log with no corresponding authenticated actor, and for the CSRF flaw, mutations arriving as GET rather than POST, which normal clients do not do.
GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.
Defender actions
- Upgrade every self-managed GitLab instance to 18.11.11, 19.0.8, 19.1.6 or 19.2.4 for its line — GitLab states these releases carry no new migrations and should need no downtime on multi-node deployments, which removes the usual reason to defer.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Impact TA0040
T1485Data Destruction
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.