VulnSocial
← Back to blog

CVE-2026-19478 – Critical unauthenticated GraphQL code‑injection in GitLab

Key takeaways

  • Severity: Critical (CVSS 9.4, CWE‑94)
  • Impact: Unauthenticated attackers can delete or modify public projects via a crafted GraphQL request.
  • Affected: Self‑managed GitLab CE/EE (versions before the 19.2.4, 19.1.6, 19.0.8, and 18.11.11 releases).
  • Status: Actively exploited in the wild within days of disclosure.
  • Action: Apply the official patch immediately; block or monitor the /api/graphql endpoint if you cannot upgrade.

Overview

CVE-2026-19478 is a critical unauthenticated code‑injection flaw discovered in the GraphQL API of self‑managed GitLab (both Community and Enterprise editions). The vulnerability allows an attacker to inject a malicious GraphQL directive that triggers arbitrary method invocation on the server, effectively giving the attacker the ability to delete or modify public projects and associated user data with a single request.

The flaw was publicly disclosed on 2026‑08‑17. Within 24 hours, security researchers observed active exploitation attempts in the wild, and by 2026‑08‑21 the number of reported exploitation events spiked to 28 in a single day. Over the first 12 days after disclosure, the vulnerability accumulated 168 mentions across security feeds, with a consistent presence of active exploitation reports.

GitLab released patches on the day of disclosure for the following versions:

  • 19.2.4
  • 19.1.6
  • 19.0.8
  • 18.11.11

Technical Details

The vulnerability lives in the GraphQL endpoint POST /api/graphql. By supplying a specially crafted query that includes a malicious directive (e.g., @_method), an attacker can cause the GraphQL resolver to invoke any Ruby method on the server. This is a classic case of CWE‑94: Improper Control of Generation of Code.

A minimal malicious payload looks like:

query {
  project(fullPath: "public/project") {
    ... on Project {
      name @_method(name: "destroy!")
    }
  }
}

When processed, the @_method directive calls destroy! on the Project object, deleting the targeted public project. Because the GraphQL endpoint does not enforce authentication for public project queries, the attack can be performed without any credentials.

Key technical attributes

  • CVSS v3.1: 9.4 (Critical) – Network, Unauthenticated, High Impact on Integrity & Availability.
  • CWE: 94 – Improper Control of Generation of Code (Code Injection).
  • EPSS: 0.7 % (51st percentile) – indicates a non‑negligible likelihood of exploitation.
  • Exploitability: Public PoCs and Nuclei detection templates are already available, confirming low barrier to weaponization.

Severity & Impact

  • CVSS 9.4 (Critical) – the flaw is exploitable remotely without authentication and results in complete loss of project data.
  • Integrity & Availability are directly compromised; confidentiality is less affected because the attack targets public resources.
  • Active exploitation has been observed on multiple days, with a peak of 28 exploitation reports on 2026‑08‑21.
  • EPSS 0.7 % places the vulnerability in the 51st percentile for exploitation likelihood, reinforcing the urgency.

Affected Products

Self‑managed GitLab Community Edition (CE) and Enterprise Edition (EE) installations running any version prior to the patched releases listed above are vulnerable. The issue does not affect GitLab.com SaaS instances, which have separate hardening controls.

For a complete list of affected versions and build numbers, see the official CVE page: https://vulnsocial.com/cve/CVE-2026-19478.

Actionable Insights – What to Do Now

  1. Verify your GitLab version – run gitlab-rake gitlab:env:info and note the CE/EE version.
  2. Apply the official patch immediately. For Debian/Ubuntu‑based installations: 
    sudo apt-get update && sudo apt-get install gitlab-ee=19.2.4
    Adjust the package name and version for your distribution.
  3. If you cannot upgrade today, block the GraphQL endpoint at the perimeter:
    • Add a firewall rule to deny inbound traffic to /api/graphql.
    • Or configure a WAF rule that drops requests containing the @_method directive.
  4. Enable and monitor audit logging for GraphQL queries. Look for:
    • Requests containing @_method or other custom directives.
    • Unexpected POST /api/graphql traffic from unauthenticated IPs.
  5. Deploy detection using the publicly available Nuclei template: 
    nuclei -u https://your-gitlab-instance/api/graphql -t https://github.com/projectdiscovery/nuclei-templates
  6. Review recent project activity – check for any sudden deletions or modifications of public projects and restore from backups if needed.
  7. Consider disabling GraphQL if your organization does not use it. This can be done via the gitlab.rb configuration: 
    gitlab_rails['gitlab_graphql_enabled'] = false
    Then run gitlab-ctl reconfigure.

Remediation & Mitigation (Step‑by‑Step)

  1. Identify – Determine the exact GitLab version running on each self‑managed instance.
  2. Patch – Upgrade to the latest patched version (19.2.4, 19.1.6, 19.0.8, or 18.11.11) or apply the back‑ported security fix if you use a custom branch.
  3. Block – If upgrade is delayed, restrict access to /api/graphql using network ACLs, WAF, or reverse‑proxy rules.
  4. Log – Enable detailed request logging for the GraphQL endpoint and ship logs to a SIEM.
  5. Detect – Deploy the Nuclei template and schedule regular scans against your GitLab instances.
  6. Validate – After patching, run a test query to confirm the vulnerability is mitigated.
  7. Recover – Audit recent project deletions; use backups to restore any lost data.

References

Bottom Line

CVE-2026-19478 is a Critical unauthenticated code‑injection bug in the GraphQL layer of self‑managed GitLab. Active exploitation is already occurring, and the impact—loss of public project data—can be severe. Apply the official patch now, block the vulnerable endpoint if you cannot upgrade, and enable robust monitoring to detect any lingering attempts.

#CVE202619478 #Critical #GitLab #GraphQL #Exploit #Patch #CISAKEV