Critical GitLab CVE-2026-19478 Under Active Exploitation After Emergency Patch
Active exploitation detected days after patch for critical unauthenticated code injection in GitLab's GraphQL interface.
Within days of a patch being released, GitLab is scrambling to contain an unauthenticated code injection vulnerability in its GraphQL interface that has already come under active exploitation. The flaw, tracked as CVE-2026-19478 and rated 9.4 on the CVSS scale, allows attackers to modify or delete public projects without credentials, forge merge records, and ban maintainers, according to watchTowr principal researcher Jake Knott who reported the details CVE-2026-19478 is currently under active exploitation.
The vulnerability stems from how the platform handles queries through its GraphQL layer, a query language that lets clients request exactly the data they need but also introduced an injection vector when a specific directive was mishandled. Knott noted that the severity comes from the lack of authentication requirements for certain destructive actions; an unauthenticated actor can exploit the flaw against public repositories to modify or delete projects entirely, while attackers who compromise authenticated users can forge merge records to impersonate contributors and force maintainers to ban themselves from their own projects.
GitLab responded to the report by jumping outside its standard release schedule to issue an emergency patch on August 17, addressing the issue across multiple supported branches. The fixes are available in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, with the advisory detailing the impact on self-managed CE and EE instances affected by the bypass GitLab issued an emergency patch.
Beyond updating the software, GitLab outlined immediate mitigations for administrators who cannot patch instantly or are managing environments with strict uptime requirements. The vendor recommended restricting access to the /api/graphql endpoint at the network level as a stopgap measure, acknowledging that the exposure affects the query interface broadly enough that network segmentation might be the only way to block exploitation before the code update lands in every environment.
The rapid pace of exploitation highlights the narrow window between disclosure and attack when an unauthenticated code injection targets a development platform’s core interface. Knott’s report of activity against CVE-2026-19478 confirms that attackers are prioritizing capabilities that let them alter public project content or wipe repositories without authentication, turning the repository management tools themselves into weapons for anyone who can query them.