GitLab has released security fixes for a critical code injection vulnerability, CVE-2026-19478, that could allow unauthenticated users to remotely modify or delete public projects and user data on affected self-managed Community and Enterprise Edition installations.
TL;DR
- GitLab patched CVE-2026-19478, a critical GraphQL code injection vulnerability with a CVSS score of 9.4.
- Affected self-managed GitLab CE/EE installations should upgrade immediately to 18.11.11, 19.0.8, 19.1.6 or 19.2.4.
- GitLab also fixed high-severity CVE-2026-19650, while GitLab.com and GitLab Dedicated are already patched.
GitLab announced the fixes in an August 17, 2026 critical patch release, covering GitLab Community Edition (CE) and Enterprise Edition (EE).
The most serious vulnerability, CVE-2026-19478, is a code injection issue involving a GraphQL directive. GitLab assigned it a CVSS score of 9.4 and said that, under certain conditions, an unauthenticated user could remotely modify or delete public projects and user data.
Which GitLab Versions Are Affected?
CVE-2026-19478 affects GitLab CE and EE versions from 18.2 before 18.11.11, version 19.0 before 19.0.8, version 19.1 before 19.1.6 and version 19.2 before 19.2.4.
The company released GitLab 18.11.11, 19.0.8, 19.1.6 and 19.2.4 to address the vulnerability and urged administrators running affected self-managed installations to update quickly.
“We strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately,” GitLab said.
Administrators can follow GitLab’s official update guidance to upgrade their installations.
Meanwhile, GitLab.com and GitLab Dedicated already run patched versions, meaning customers using those services do not need to take action related to the update.
Topics For More Insights- Tenable Uncovers “GerriScary” Supply‑Chain Compromise Vulnerability In Popular Google’s Open‑Source Projects
- New AI Model Of Meta Hacks Another Company During Internal Cybersecurity Testing
GitLab Also Fixes High-Severity GraphQL CSRF Vulnerability
The same patch release resolves a second GraphQL-related security flaw, tracked as CVE-2026-19650.
Rated 7.1 on the CVSS scale, the cross-site request forgery (CSRF) vulnerability affects GitLab’s GraphQL multiplex query handler. According to GitLab, improper request validation could, under certain conditions, allow an unauthenticated user to execute mutations through GET requests.
The second vulnerability affects the same GitLab CE and EE version ranges as CVE-2026-19478 and is fixed in the same four releases.
Both vulnerabilities were reported to GitLab through its HackerOne bug bounty program. GitLab credited security researchers hiimguardian for reporting CVE-2026-19478 and kreep for reporting CVE-2026-19650.
As also noted by SecurityWeek, GitLab has not said that either vulnerability has been exploited in the wild. This means the disclosures concern confirmed vulnerabilities and available patches, not a confirmed breach or active exploitation campaign.
For organizations operating self-managed GitLab environments, the immediate priority is to determine whether their installation falls within an affected version range and apply the appropriate patched release.
