Critical GitLab flaw exploited within days
Critical GitLab flaw exploited in the wild just two days after disclosure
SecurityWeek reports that attackers began exploiting CVE-2026-19478, a critical code injection vulnerability in GitLab rated 9.4 on the CVSS scale, approximately 48 hours after the company released patches on August 17. The bug lets an unauthenticated attacker remotely alter or delete public projects and user data through a GraphQL directive — requiring no credentials, user interaction, or special configuration.
Attack surface management firm WatchTowr reproduced the vulnerability within minutes of the advisory using only the patch diff and public details. The company's honeypot infrastructure subsequently detected the first real-world exploitation attempts.
Fixes were issued for GitLab CE and EE versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. Organizations running self-managed instances are advised to patch immediately or block unauthenticated access to the /api/graphql endpoint.
Security researchers warn the flaw could drive a new wave of supply chain attacks. Mondoo co-founder Patrick Münch noted that because the vulnerability enables forging merge request records, an attacker could make malicious code changes appear to have been reviewed and approved by a trusted colleague. "Deleting a repo costs you a bad afternoon. Forging trust in it costs you every release that follows," Münch said. The compressed window between patch release and exploitation — accelerated by AI-assisted vulnerability reproduction — signals a new reality where defenders have days rather than weeks to react. GitLab.com and GitLab Dedicated instances were patched server-side and require no customer action.