- A critical GitLab vulnerability (CVE-2026-19478, CVSS 9.4) enables unauthenticated attackers to modify or delete public projects via GraphQL injection.
- Exploitation has been observed within days of disclosure, with watchTowr reproducing the flaw and detecting attacks on its honeypot network.
- Affected versions include GitLab CE/EE 18.2 through 19.2; patches are available, and organizations should immediately upgrade or restrict GraphQL API access as a mitigation.
A newly disclosed security flaw in GitLab, tracked as CVE-2026-19478, has come under active exploitation within days of public disclosure, according to watchTowr. This critical code injection vulnerability (CVSS 9.4) allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data without requiring credentials. The following versions of GitLab Community Edition (CE) and Enterprise Edition (EE) are affected: 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. Consequently, GitLab rolled out fixes in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. Preemptive exposure management firm watchTowr told The Hacker News that it was able to reproduce the vulnerability within minutes of its disclosure, adding that it observed in-the-wild exploitation against its honeypot network. “This is the new reality of vulnerability reproduction and exploitation, where AI [artificial intelligence]-enabled attackers are able to compress the time from disclosure to exploitation and ‘waiting until the next patch cycle’ is often too late,” said Jake Knott, principal security researcher at watchTowr. Meanwhile, watchTowr also noted that the vulnerability’s impact goes beyond modifying projects; an attacker can delete entire repositories, forge merge records, and ban project maintainers. Organizations running internet-facing self-hosted GitLab instances should prioritize upgrading to a patched release. If immediate patching is not possible, it’s advised to restrict unauthenticated access to “/api/graphql”, or remove public repository access entirely as a mitigation.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
