← News
/PLAYBOOK · 2026-08-18

CVE-2026-19478: GitLab GraphQL Directive Unauthenticated Remote Tamper, CVSS 9.4 Emergency Patch

GitLab shipped an emergency patch on 17 Aug for CVE-2026-19478, an unauthenticated GraphQL-directive remote-tamper flaw, CVSS 9.4. No credentials required to remotely modify or delete public project data.

Incident Overview

CVE-2026-19478, an unauthenticated remote-tamper flaw in GitLab GraphQL directives, received an emergency fix from GitLab on 17 Aug 2026. CVSS 9.4, Critical. The bug sits in the GraphQL API of self-managed GitLab Community Edition (CE) and Enterprise Edition (EE). Under specific conditions an unauthenticated attacker can remotely modify or delete public project and user data over the network. GitLab.com and GitLab Dedicated already run patched builds — no action. All self-managed users must upgrade immediately.

Technical Details

CVE-2026-19478 is a handling defect in the GitLab GraphQL parse layer for certain directives. No credentials required. An attacker sends a crafted GraphQL request to an internet-exposed self-managed instance and triggers unauthorized mutations. Affected lines: 18.2 through 18.11, 19.0, 19.1, 19.2. Branches 18.2–18.10 get no backport; jump to 18.11.11 or later. CVSS vector: network (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), changed scope (S:C).

Same release also ships CVE-2026-19650, a GraphQL multiplex-query CSRF bug, CVSS 7.1 High, user interaction required. Both went out outside the monthly patch cycle. GitLab did not name the abused GraphQL directive or extra exploit preconditions. Technical details typically publish 90 days after the patch. Researchers already published working exploit code for another self-managed GitLab bug in Jul 2026. Stack that with this emergency disclosure: compress the upgrade window to 24 hours.

Impact Assessment

GitLab sits at the core of enterprise R&D. Large numbers of tech firms, internet companies, and open-source orgs host source, CI/CD configs, container images, and project docs on self-managed instances. Weaponized, CVE-2026-19478 lets an attacker remotely delete public projects, alter issues and merge requests, tamper with CI variables, or inject malicious pipeline scripts — direct software-supply-chain risk. Combined with CVE-2026-19650 CSRF, an attacker can widen the blast radius by luring a logged-in user to click a crafted link.

Self-managed GitLab has been in in-the-wild exploit monitoring since Jul 2026. Unpatched instances routinely get Web Shells, stolen Runner Token, and poisoned pipeline artifacts. CVE-2026-19478 is in the same severity class as the 2025 GitLab arbitrary user password-reset bug (CVE-2025-0471). Unpatched instances enter a high-risk exposure window.

Remediation

Upgrade every self-managed GitLab instance to a fixed release now:

Instances still on 18.10 and below: no patches for 18.2–18.10. Cross-upgrade to 18.11.11. Path: step through an 18.11 intermediate (e.g. 18.11.10), then the security bump. During the upgrade, temporarily block public access to `/api/graphql` at the edge firewall or reverse proxy; allow only internal CI and ops IPs. CISA and national CERTs are expected to add this CVE to the Known Exploited Vulnerabilities catalog (KEV) within days. Finance, telecom, and government self-managed GitLab operators should treat this as priority.

References