GitLab CVE-2026-19478
GitLab has issued a security patch for a critical security vulnerability. It impacts Community Edition as well as the Enterprise Edition of GitLab. It will enable remote modification/deletion of certain public projects/user data in some cases.
The vulnerability has been assigned CVE ID CVE-2026-19478. GitLab categorized this as Critical with CVSS Score of 9.4.
The patch was made available on August 17, 2026. This was outside GitLab's usual schedule of twice-monthly updates. It came just five days after a routine patch release that carried no critical-rated issues.
Let me walk you through the GitLab CVE-2026-19478 vulnerability and what self-managed administrators need to do.
Key Points About the Vulnerability
- CVE-2026-19478 affects GitLab CE and EE versions 18.2 through 19.2.3
- CVSS score: 9.4 (Critical)
- Unauthenticated attackers can modify or delete public projects
- Affects self-managed installations only
- GitLab.com and GitLab Dedicated are already patched
- Fixed in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11
What's the Problem?
The GitLab CVE-2026-19478 vulnerability is a GraphQL directive issue. It can be used by an unauthentic user to change or delete public projects and user data. No credentials are required. No victim interaction is needed.
The CVSS vector published for the flaw indicates that it can be exploited over a network by an attacker holding no credentials. The attacker doesn't need any action from a victim.
GitLab hasn't named the specific GraphQL directive involved. They also haven't detailed the exact conditions necessary for exploitation. That information will remain private for now.
Who Is Affected?
The GitLab CVE-2026-19478 vulnerability affects self-managed installations only.
Affected Versions:
- All versions from 18.2 before 18.11.11
- 19.0 before 19.0.8
- 19.1 before 19.1.6
- 19.2 before 19.2.4
The 18.2 through 18.10 branches are affected. The fixes do not extend to these older versions.
Fixed Versions:
- GitLab 19.2.4
- GitLab 19.1.6
- GitLab 19.0.8
- GitLab 18.11.11
What About GitLab.com?
GitLab.com and GitLab Dedicated are already running the patched version. Customers using those services do not need to take any action.
The Second Issue
The GitLab CVE-2026-19478 vulnerability patch release also fixed another flaw. CVE-2026-19650 is rated High with a CVSS score of 7.1.
What It Is:
This is a cross-site request forgery weakness in the GraphQL multiplex query handler. It could allow an unauthenticated user to execute mutations via GET requests. The reason for this lies in improper request validation.
The Difference:
Unlike CVE-2026-19478, the existing vulnerability requires user action. That makes it less severe but still worth patching.
No Public Exploit Code
The GitLab CVE-2026-19478 vulnerability advisory discloses no exploitation of either flaw. No public exploit code has surfaced on GitHub as of August 18, 2026.
That doesn't mean you should wait. Attackers are constantly scanning for unpatched systems. The sooner you update, the safer you are.
The 90-Day Disclosure Window
- GitLab follows a 90-day disclosure window. The company said it makes the issues detailing each vulnerability public on its issue tracker 90 days after the release that patched them.
- GitLab's June 10, 2026 patch release put that window at 30 days. That places technical details of both flaws at around mid-November 2026.
What Self-Managed Administrators Should Do
The GitLab CVE-2026-19478 vulnerability requires immediate action:
Update Immediately:
- Upgrade to GitLab 19.2.4
- Or upgrade to 19.1.6, 19.0.8, or 18.11.11
- Choose the version that matches your current deployment
Check Your Version:
- Identify which version of GitLab you're running
- If you're on versions 18.2 through 18.10, you're affected
- If you're on 19.0, 19.1, or 19.2, you're affected
No Downtime Required:
- The update introduces no new migrations
- It is not expected to require downtime on multi-node deployments
Wrapping It Up
The GitLab CVE-2026-19478 vulnerability is a critical flaw affecting self-managed installations. Unauthenticated attackers can modify or delete public projects and user data.
Key points to remember:
- CVE-2026-19478 is a critical GraphQL directive flaw
- CVSS score: 9.4
- Affects self-managed GitLab CE and EE
- Fixed in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11
- GitLab.com is already patched
- No public exploit code available
Self-managed administrators should update immediately. Check the GitLab version you are using and implement the required patch.
GitLab CVE-2026-19478 is a prime example of how even a highly maintained platform can still have vulnerabilities. Stay updated. Stay secure.
FAQ Section
What is the GitLab CVE-2026-19478 vulnerability?
A critical GraphQL directive vulnerability is that it enables an attacker to manipulate and delete public projects and user data without being authenticated.
Which versions are affected?
All versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.
Is GitLab.com affected?
No. GitLab.com and GitLab Dedicated are already patched. Customers don't need to take action.
What is the second vulnerability?
CVE-2026-19650 is a high-severity Cross-Site Request Forgery vulnerability in the handling of GraphQL multiplex queries. This vulnerability needs interaction from the user.
What do I need to do?
Patch your self-managed GitLab to version 19.2.4, 19.1.6, 19.0.8, or 18.11.11 immediately.
