Critical GitLab GraphQL Flaw Lets Attackers Delete Public Projects (CVE-2026-19478)

GitLab has issued out-of-band security updates to remediate a critical vulnerability in its Community Edition (CE) and Enterprise Edition (EE) platforms that could allow an unauthenticated remote attacker to modify or delete public projects and user data. Tracked as CVE-2026-19478, the flaw resides in a GraphQL directive and carries a CVSS score of 9.4, placing it firmly in Critical territory. The vulnerability can be triggered over the network without credentials and without any user interaction, making exposure of self-managed GitLab instances particularly dangerous. GitLab has not publicly disclosed which GraphQL directive is implicated or the precise conditions required for exploitation, and no public exploit code has surfaced as of the advisory. Administrators of public-facing self-hosted GitLab instances can use tools such as a port scanner to verify which services are exposed and a SSL/TLS checker to confirm their instances are properly encrypted, reducing the attack surface available to potential threat actors.

The patch release, published on August 17, 2026, falls outside GitLab's regular twice-monthly cadence (which lands on the second and fourth Wednesdays) and arrives just five days after a routine update that carried no critical-rated issues. Only self-managed installations require action; GitLab.com and GitLab Dedicated are already running the patched code. The fixes ship in GitLab versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, covering all releases from 18.2 onward. Older branches between 18.2 and 18.10 do not receive patches, meaning organizations running these versions must upgrade to a supported branch to close the hole. The update introduces no new database migrations and is not expected to require downtime on multi-node deployments.

Bundled into the same release is a second vulnerability, CVE-2026-19650, rated High with a CVSS score of 7.1. This issue stems from a cross-site request forgery (CSRF) weakness in GitLab's GraphQL multiplex query handler, which under certain conditions permitted unauthenticated users to execute mutations via GET requests due to improper request validation. Unlike the critical flaw, exploitation requires user interaction. GitLab said technical details for both vulnerabilities will be published on its issue tracker roughly 90 days after the patch release, placing public disclosure around mid-November 2026.

The disclosure follows a July 2026 report in which researchers released working exploit code for a separate GitLab flaw affecting self-managed servers, underscoring the value of timely patching for organizations running their own DevOps infrastructure. Security teams should prioritize upgrades immediately, audit access logs for anomalous GraphQL activity, and review project-level permissions on public repositories. Defenders can supplement their hardening efforts by running a privacy checkup on endpoints used to administer GitLab and verifying outbound traffic integrity with a DNS leak test to ensure no rogue resolvers are intercepting requests to self-hosted instances.