UPDATE — GitLab's unauthenticated GraphQL flaw is being exploited two days after its patch, reproduced from the advisory and the patch alone, and Switzerland's NCSC has flipped its status to actively exploited
UPDATE · originally covered CVE-2026-19478 — GitLab ships an out-of-band critical patch for a GraphQL directive flaw that lets an unauthenticated caller modify or delete public projects and user data (CVSS 9.4) (2026-08-19)
the exposure has moved from disclosed to exploited, and the interval is the finding. GitLab patched CVE-2026-19478 on 2026-08-17 in 19.2.4, 19.1.6, 19.0.8 and 18.11.11, and the original entry recorded that no party reported exploitation and that GitLab was withholding technical detail for 90 days. The research firm watchTowr states that despite no public exploit code being available, it reproduced the vulnerability within minutes of its disclosure armed only with the advisory details and the patch (SecurityWeek, 2026-08-20). Its reproducibility warning came on 18 August, one day after the patch; on Wednesday 19 August it began seeing in-the-wild exploitation of the vulnerability across its honeypot network (CSO Online, 2026-08-19). Switzerland's NCSC, which had carried the flaw with an unknown exploitation status since 18 August, revised its advisory on 2026-08-21 to record it as actively exploited, citing the reporting of those detections (NCSC Switzerland, 2026-08-21). Withholding the technical detail bought GitLab's self-managed estate one day.
Two corrections to the original entry's mechanics, both from the sources above. The flaw is a code-injection issue reached through a GraphQL directive — the @-prefixed construct the published hunt string @gl_introduced is an instance of — and not, as the earlier framing had it, a query alias; GitLab's own statement and the independent reporting both use the directive terminology (CSO Online, 2026-08-19). And the bundled second flaw CVE-2026-19650, the cross-site request forgery issue, is the one that lives in the GraphQL multiplex query handler (CSO Online, 2026-08-19) — that component belongs to the CSRF flaw, not to CVE-2026-19478, and the two mechanisms should not be merged. Newly on the record: the flaw reached GitLab privately through its bug-bounty programme rather than being found internally (CSO Online, 2026-08-19).
Whilst no public exploit code is available, WatchTowr was able to reproduce the vulnerability within minutes of its disclosure, armed only with the advisory details and patch.
On Wednesday, watchTowr started seeing in-the-wild exploitation of this vulnerability across its honeypot network.
is described as a code injection issue through the GraphQL directive and was reported privately to GitLab through its bug bounty program on HackerOne.
Defender actions
- Search web and reverse-proxy access logs for requests to the GraphQL API endpoint carrying the string
@gl_introduced, and treat any unauthenticated request to that endpoint as a probe or an exploitation attempt. Because the flaw's impact is modification and deletion rather than disclosure, pair the log search with a check of project and user-data integrity against backups over the window from 2026-08-17 onward, on any self-managed instance that was internet-reachable and unpatched.
ATT&CK mapping
1 technique mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.