CVE-2026-19478
published 2026-08-17CVE-2026-19478: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4…
PriorityP190critical9.1CVSS 3.1
AVNACLPRNUINSUCNIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
60.20%
99.1th percentile
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 18.2 < 18.11.11 | 18.11.11 |
| gitlab | gitlab | >= 18.2.0 < 18.11.11 | 18.11.11 |
| gitlab | gitlab | >= 19.0 < 19.0.8 | 19.0.8 |
| gitlab | gitlab | >= 19.0.0 < 19.0.8 | 19.0.8 |
| gitlab | gitlab | >= 19.1 < 19.1.6 | 19.1.6 |
| gitlab | gitlab | >= 19.1.0 < 19.1.6 | 19.1.6 |
| gitlab | gitlab | >= 19.2 < 19.2.4 | 19.2.4 |
| gitlab | gitlab | >= 19.2.0 < 19.2.4 | 19.2.4 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
vulncheck9.4CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
Improper Control of Generation of Code ('Code Injection') in GitLab
vendor_gitlab·2026-08-17·CVSS 9.4
CVE-2026-19478 [CRITICAL] CWE-94 Improper Control of Generation of Code ('Code Injection') in GitLab
Improper Control of Generation of Code ('Code Injection') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
Affected products: GitLab
Affected versions: >=18.2, =19.0, =19.1, =19.2, <19.2.4 (affected)
Solution: Upgrade to versions 18.11.11, 19.0.8, 19.1.6, 19.2.4 or above.
Credit: Thanks [hiimguardian](https://hackerone.com/hiimguardian) for reporting this vulnerability through our HackerOne bug bounty program
VulDB
GitLab up to 18.11.10/19.0.7/19.1.5/19.2.3 GraphQL Directive authorization (WID-SEC-2026-2882)
vuldb·2026-09-06·CVSS 9.1
CVE-2026-19478 [CRITICAL] GitLab up to 18.11.10/19.0.7/19.1.5/19.2.3 GraphQL Directive authorization (WID-SEC-2026-2882)
A vulnerability was found in GitLab up to 18.11.10/19.0.7/19.1.5/19.2.3. It has been declared as critical. This affects an unknown part of the component GraphQL Directive. The manipulation results in missing authorization.
This vulnerability is cataloged as CVE-2026-19478. The attack may be launched remotely. There is no exploit available.
It is recommended to upgrade the affected component.
GHSA
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allo
ghsa_unreviewed·2026-08-17
CVE-2026-19478 [CRITICAL] CWE-94 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allo
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
VulnCheck
GitLab gitlab Improper Control of Generation of Code ('Code Injection')
vulncheck·2026·CVSS 9.4
CVE-2026-19478 [CRITICAL] GitLab gitlab Improper Control of Generation of Code ('Code Injection')
GitLab gitlab Improper Control of Generation of Code ('Code Injection')
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
Affected: GitLab gitlab
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.govinfosecurity.com/gitlab-code-injection-flaw-exploited-in-wild-a-32606
Exploit PoC: https://vulncheck.com/xdb/20ec5b3a43f5; https://vulncheck.com/xdb/9d73feb6058c
No detection rules found.
Nuclei
GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation
nuclei·CVSS 9.4
CVE-2026-19478 [CRITICAL] GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation
GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
Template:
id: CVE-2026-19478
info:
name: GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation
author: 0x_Akoko,DhiyaneshDk
severity: critical
description: |
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or de
Hackernews
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
blogs_hackernews·2026-09-11·CVSS 9.1
CVE-2026-85706 [CRITICAL] GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure.
The vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under certain conditions.
The problem, per GitLab, stems from "improper path confinement and missing authentication enforcement in the repository commits API."
The issue
Hackernews
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
blogs_hackernews·2026-08-24
CVE-2026-19478 ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
A package gets installed. A login prompt opens. A box sits exposed to the internet. Nothing looks unusual yet.
That’s roughly the mood this week. Trusted tools turn hostile, old weak spots get fresh attention, AI makes exploit work cheaper, and researchers keep finding attacks that sound harder than they actually are.
Plenty to clean up. Here’s the short version.
## ⚡ Threat of the Week
U.S. Warns of AI-Powered Attacks on Siemens PLCs — Threat actors are using AI to write exploit scripts targeting internet-exposed Siemens S7 Series program
Checkpoint
24th August – Threat Intelligence Report
blogs_checkpoint·2026-08-24
CVE-2026-19478 24th August – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 24th August – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 24th August, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Latvia’s Road Traffic Safety Directorate (CSDD) has confirmed a breach affecting payment records of more than 1.2 million people – roughly two-thirds of the country’s population – as well as 200,000 organizations. The stolen data included identification numbers, license plates, payment amounts, dates and addresses. Attackers reportedly exploi
Hackernews
GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure
blogs_hackernews·2026-08-21·CVSS 9.4
CVE-2026-19478 [CRITICAL] GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure
A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr.
The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions without requiring credentials, user interaction, or obscure configuration.
The following versions of GitLab Community Edition (CE) and Enterprise Edition (EE) are affected by the f
Hackernews
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
blogs_hackernews·2026-08-18·CVSS 9.4
CVE-2026-19478 [CRITICAL] Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data.
The flaw, tracked as CVE-2026-19478 , has been rated Critical by GitLab and assigned a CVSS score of 9.4.
Released on August 17, 2026, the critical patch release arrived outside the company's usual schedule of twice-monthly updates on the second and fourth Wednesd
2026-08-17
Published
Exploited in the wild