www.it-connect.fr
GitLab Critical CVE-2026-19478 Is Already Being Exploited, Just Two Days After the Patch
Fixed by GitLab on August 17, 2026 with an emergency update, the CVE-2026-19478 flaw allows public repositories to be modified or deleted without any authentication at all. The problem is that this vulnerability is reportedly already being exploited... Here is what we know.
An emergency patch released for a critical GitLab vulnerability
On August 17, 2026, GitLab released versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11 for the Community Edition (CE) and Enterprise Edition (EE). These were emergency updates released outside the usual update cycle. Why? To patch a critical security flaw in GitLab, CVE-2026-19478.
This vulnerability (CVE-2026-19478) is described as a code injection issue exploitable through a GraphQL directive. "GitLab fixed an issue that, under certain conditions, could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.", the vendor says. We are talking about deleting public projects without authentication, using a single HTTP request, so this is very serious. However, this is about destruction and modification, not data theft (but then again, if it is public, there is nothing to steal).
As proof, the flaw carries a CVSS score of 9.4 out of 10. Based on the published information, it can be exploited easily via a remote attack with no privileges required: something watchTowr confirmed, as we will see later.
The versions affected by this critical flaw, in both CE and EE, are the following:
- All versions from 18.2 up to, but not including, 18.11.11
- Versions 19.0 earlier than 19.0.8
- Versions 19.1 earlier than 19.1.6
- Versions 19.2 earlier than 19.2.4
Only self-hosted instances need to be updated. GitLab says that GitLab.com and GitLab Dedicated are already running a patched version and that no action is required from customers of those offerings. The same update also fixes another issue: CVE-2026-19650, a CSRF flaw (CVSS score of 7.1) in the GraphQL multiplexed request manager, which requires user interaction to exploit.
CVE-2026-19478: a flaw that is already being exploited
In a LinkedIn post, watchTowr says it was able to exploit the vulnerability quickly, despite the absence of a public PoC. "Using Project Red, our agentic tool for reproducing vulnerabilities and exploits, watchTowr reproduced the vulnerability in just minutes after disclosure, relying solely on the public advisory and the code changes introduced in GitLab’s patch.", the company says.
More importantly, the very next day, watchTowr says it observed exploitation attempts targeting this flaw on its honeypot network. That means attackers are also trying to abuse this critical vulnerability to cause damage... But for them, code modification is especially interesting, as it could be used to inject malicious code into a legitimate repository, rather than simply destroy data. And once again, cybercriminals are acting fast: less than two days passed between disclosure and the first exploitation attempts.
Patch now and do not wait: the risk is anything but theoretical for self-hosted instances. This is not the first time GitLab has triggered this kind of alert, and it often hurts.
