CVE-2026-19478: GitLab GraphQL Code Injection Actively Exploited; Unauthenticated Attackers Can Rewrite Public Project Data

GitLab disclosed GraphQL code-injection vulnerability CVE-2026-19478, CVSS 9.4. Unauthenticated attackers can modify or delete public projects and their data via crafted GraphQL directives. watchTowr confirmed in-the-wild exploit attempts within days of disclosure. All self-managed GitLab CE and EE users must upgrade immediately to 19.2.4, 19.1.6, 19.0.8, or 18.11.11.

GitLab issued an emergency out-of-band security update for a GraphQL code-injection vulnerability tracked as CVE-2026-19478. CVSS 9.4. Affects self-managed GitLab Community Edition and Enterprise Edition. Unauthenticated remote attackers can inject via the GraphQL endpoint, modify or delete public project data, and rewrite project metadata. watchTowr confirmed in-the-wild exploit attempts against internet-exposed GitLab instances within days of disclosure. DevOps teams need to act now.

Incident Overview

CVE-2026-19478 is a GraphQL API directive-injection flaw. Attack vector is fully network-based. No user interaction. No prior credentials. The bug abuses insufficient validation in GraphQL directive handling, allowing arbitrary data modification in a public-project context. The GraphQL endpoint is a core GitLab API exposed by default, and many self-managed instances allow public project access, so the blast radius covers all unpatched self-managed GitLab deployments.

Technical Details

GitLab's GraphQL API lets clients attach directives that describe extra query/mutation behavior (field formatting, cache policy, etc.). Root cause of CVE-2026-19478: GitLab did not adequately filter or escape directive arguments for some directives, so attackers can craft directive payloads that turn arbitrary input into executable statements.

Exploit path in outline:

• Attacker locates `/api/graphql` on the target self-managed GitLab instance

• Sends an anonymous GraphQL query carrying a malicious directive

• Server executes attacker-controlled arguments while parsing the directive

• Arbitrary modify or delete completes in a public-project context

Even if a project is private, a public project can still provide the initial foothold, then other data can be rewritten within the permission model. watchTowr notes attackers can finish large-scale automated scan-and-exploit in hours.

Impact Assessment

CVSS: 9.4 (Critical). Attack vector: network. Attack complexity: low. Privileges required: none (unauthenticated). User interaction: none. PoC public: technical details and exploit path published by multiple research teams. In-the-wild: yes. watchTowr confirmed automated scanning and exploit attempts within days of disclosure. Impact surface: all self-managed GitLab CE and EE instances not upgraded to a fixed release, especially internet-exposed instances with public projects.

Affected Scope and Versions

• Self-managed GitLab Community Edition and Enterprise Edition

• Affected versions: from before 18.11 through 19.2.4 (including 19.0.x, 19.1.x, 19.2.0–19.2.3 branches)

• Official fixed versions: 19.2.4, 19.1.6, 19.0.8, 18.11.11

• Hosted (GitLab.com and Dedicated) not affected; GitLab already applied the fix on the platform

Remediation

• Immediately upgrade self-managed GitLab to the fixed release on the corresponding branch (19.2.4 / 19.1.6 / 19.0.8 / 18.11.11)

• Before upgrade, restrict anonymous access to `/api/graphql` via NGINX reverse proxy or WAF; reject unauthorized GraphQL requests

• Temporarily set all public projects to private to close the exploit path; reopen after the patch is in

• Audit repository content on pre-upgrade instances: commit history, branch protection, merge-request state, member permissions, and Webhook config for tampering

• Rotate all tokens integrated with GitLab: CI/CD runner tokens, third-party OAuth app secrets, Webhook credentials

• Monitor GitLab audit log (`/admin/audit_events`) for anomalous GraphQL calls, especially complex queries with directive arguments

• Inventory internet exposure of GitLab instances; shut unnecessary public access; open management ports only on trusted networks

Detection Rules

• WAF/IPS: block requests to `/api/graphql` that contain abnormal directive keywords and oversized arguments

• GitLab audit log: monitor mutations from unauthenticated callers, especially sensitive operations such as projectUpdate, repositoryFileUpdate, branchDelete

• Repo content comparison: use git reflog and remote history snapshots to detect unauthorized commits, tag pushes, and branch deletions

• EDR: GitLab workers (puma, sidekiq) spawning abnormal child processes or executing unexpected shell commands

• Traffic: watch GitLab outbound connections to unexpected domains/IPs on the network egress; flag potential credential theft

GitLab is the hub for DevOps code collaboration and CI/CD. CVE-2026-19478 is not just single-project tampering. Attackers can break software-supply-chain integrity—rewrite release tags, poison CI config, alter build scripts. After upgrade, re-examine GitLab network exposure, GraphQL access control, and credentials of downstream systems integrated with GitLab, so attackers cannot persist with old credentials after the patch.

References

• GitLab official security release notes

• watchTowr: GitLab CVE-2026-19478 exploit analysis

• The Hacker News: GitLab GraphQL vulnerability exploited in the wild