Full research report
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
Executive assessment
GitLab's emergency release of 17 August 2026 addresses two GraphQL-layer vulnerabilities that collectively expose self-managed instances to unauthenticated write and delete operations against public projects. CVE-2026-19478 is the more critical: its CWE-94 classification and CVSS vector confirm a low-complexity, no-credential, no-interaction network attack path, making it a high-priority target for adversaries once technical details become public in November 2026. The secondary CSRF flaw (CVE-2026-19650) compounds the risk by opening a social-engineering vector for state-changing mutations via GET requests. A significant remediation gap exists for organisations running GitLab 18.2 through 18.10, which are within the affected range but receive no patch under GitLab's current support policy. No exploitation evidence or public PoC was found during this investigation, but the attack surface and impending technical disclosure window warrant immediate patching and active monitoring by all self-managed GitLab operators.
What happened
GitLab issued an emergency out-of-cycle critical security release on 17 August 2026, addressing two GraphQL vulnerabilities in Community Edition (CE) and Enterprise Edition (EE). The primary flaw, CVE-2026-19478 (CVSS 9.4), enables an unauthenticated attacker to remotely modify or delete public projects and user data via a GraphQL directive. A companion high-severity cross-site request forgery (CSRF) flaw, CVE-2026-19650 (CVSS 7.1), allows unauthenticated execution of write mutations via GET requests when a victim interacts with a malicious link. Both vulnerabilities were reported through GitLab's HackerOne bug bounty programme and received patches in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
Affected scope
GitLab CE/EE self-managed installations from version 18.2 through 19.2.3. GitLab.com and GitLab Dedicated are already running patched versions and require no action. Installations on branches 18.2 through 18.10 fall within the affected range but do not receive patches, as those branches are beyond GitLab's supported maintenance window.
Technical assessment
CVE-2026-19478 is classified as CWE-94 (improper control of code generation) with a CVSS vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, confirming low-complexity network exploitation with no credentials and no victim interaction required, resulting in high integrity and availability impact. The weakness resides in GitLab's GraphQL directive handling; the specific directive and triggering conditions remain undisclosed pending GitLab's 90-day technical disclosure window (expected mid-November 2026). CVE-2026-19650 (CWE-352) exploits improper request validation in the GraphQL multiplex query handler, permitting state-changing mutations to be triggered via crafted GET requests in a CSRF scenario; it requires user interaction and scores CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L).
Recommended defensive actions
- Apply GitLab's emergency patches immediately: upgrade self-managed CE/EE to 19.2.4, 19.1.6, 19.0.8, or 18.11.11 as appropriate for your branch.
- Upgrade or migrate installations running GitLab 18.2 through 18.10 to a supported and patched branch (18.11.11 minimum), as those versions are within the vulnerable range and will not receive a fix.
- Restrict network access to GitLab's GraphQL endpoint (/api/graphql) to authenticated or internally trusted networks if immediate patching is not possible.
- Monitor GraphQL access logs for anomalous unauthenticated mutation requests targeting project modification or deletion operations.
- Subscribe to GitLab security notifications to receive future critical out-of-cycle releases without delay.
Uncertainties and evidence gaps
- The specific GraphQL directive responsible for CVE-2026-19478 and the exact conditions required for exploitation have not been disclosed; technical details are withheld until approximately mid-November 2026.
- GitLab branches 18.2 through 18.10 are within the vulnerable range but will not receive patches; GitLab has not stated whether a workaround is available for those installations.
- CISA Known Exploited Vulnerabilities catalogue inclusion could not be directly verified during this investigation (403 response); CISA advisory status remains unconfirmed.
- A prior July 2026 GitLab exploitation incident referenced in source reporting as contextual background was not investigated here; its relationship to the current disclosure, if any, is unassessed.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No exploitation confirmed and no public proof-of-concept code identified as of 18 August 2026; GitLab's advisory discloses no in-the-wild activity for either CVE.
Investigation began by verifying the primary source article's claims against GitLab's official patch release documentation and NVD entries. Both CVEs were independently confirmed across GitLab's own release page and NVD, with CVSS scores, CWE classifications, and affected versions consistent across sources. No public proof-of-concept exploit code was found in tracked repositories, and CISA KEV status could not be directly verified. GitLab's deliberate non-disclosure of technical specifics pending a 90-day window defines the current uncertainty ceiling and keeps confidence bounded by the absence of exploitation evidence.
- What claims does the primary source article make about the vulnerabilities?Fetched The Hacker News article to extract stated CVE IDs, CVSS scores, affected versions, patch versions, and exploitation statusthehackernews.com ↗
Article reports CVE-2026-19478 (CVSS 9.4, unauthenticated GraphQL code injection) and CVE-2026-19650 (CVSS 7.1, CSRF in GraphQL multiplex handler), patched 17 August 2026 in versions 19.2.4, 19.1.6, 19.0.8, 18.11.11; no exploitation or PoC disclosed.
why Establishes the baseline claims requiring independent verification; treated as untrusted reporting pending corroboration.
- Does GitLab's official release documentation confirm the stated CVE details and patch versions?Fetched GitLab's official critical patch release pagedocs.gitlab.com ↗
Confirmed CVE-2026-19478 (CVSS 9.4, CWE-94, CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, reported by hiimguardian via HackerOne) and CVE-2026-19650 (CVSS 7.1, CWE-352, CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, reported by kreep via HackerOne), along with all affected and patched version ranges.
why Primary authoritative source; confirms all core article claims and adds CWE classifications and reporter attribution not present in the article.
- Does NVD independently confirm CVE-2026-19478 as a GitLab vulnerability with the stated severity?Fetched NVD entry for CVE-2026-19478nvd.nist.gov ↗
NVD confirms GitLab CE/EE as the affected product, CVSS 9.4, CWE-94 code injection, and the described affected version ranges, independently of GitLab's own documentation.
why Provides a second authoritative, independent source domain corroborating core technical details; elevates confidence to high.
- Does NVD independently confirm CVE-2026-19650?Fetched NVD entry for CVE-2026-19650nvd.nist.gov ↗
NVD confirms GitLab CE/EE, CVSS 7.1, CWE-352 CSRF, and the same affected and patched version ranges, consistent across all prior sources.
why Independently validates the secondary CVE; both CVEs are now confirmed across two independent authoritative domains.
- Is public proof-of-concept or exploit code available for either CVE?Searched for PoC exploit code on GitHub and reviewed a community-tracked 2026 CVE PoC repositorygithub.com ↗
Neither CVE-2026-19478 nor CVE-2026-19650 appeared in the repository's indexed 2026 PoC entries; no PoC surfaced across search results.
why No weaponisable code is publicly circulating as of the investigation date, moderating the immediate exploitation risk despite the high CVSS score.
- Has CISA added either CVE to its Known Exploited Vulnerabilities catalogue?Attempted to fetch the CISA KEV catalogue directly
Request returned HTTP 403 Forbidden; CISA KEV inclusion for these CVEs could not be verified.
why Cannot confirm or deny CISA KEV status; this is recorded as a material uncertainty in the assessment.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 2 corroborating, 0 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| NVDcve | ok900 records | Primary evidence2 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok9 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| CISA KEVkev | ok1666 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5324 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok685 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1009 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 6 opened outside the registered collection
Vendor & gov advisories3
Official GitLab patch release confirming both CVEs, CVSS vectors, affected versions, and HackerOne reporter attribution
NVD independently confirms CVSS 9.4, CWE-94 code injection, network-accessible unauthenticated vector for GitLab CE/EE
NVD independently confirms CVSS 7.1, CWE-352 CSRF, user-interaction requirement for GitLab CE/EE
Analysis & research1
Primary reporting; patch details and scope claims verified against official sources