Update, August 22, 2026: This vulnerability has since come under active exploitation. Read our follow-up coverage on the confirmed attacks for the latest details.
GitLab has released emergency patches for a critical security flaw that allowed attackers to delete or alter public projects and user data on self-managed GitLab servers without needing a username, password, or any prior access at all.
The company published the fix on August 17, 2026, addressing two related issues in GitLab’s GraphQL API. The more serious of the two, tracked as CVE-2026-19478, carries a CVSS severity score of 9.4 out of 10, putting it firmly in the critical category. According to GitLab’s advisory, the bug lets an unauthenticated attacker send a specially crafted GraphQL directive to a vulnerable GitLab instance and use it to remotely modify or delete public projects and the user data tied to them. No account, no login, and no interaction from a victim is required.
A second, less severe flaw, CVE-2026-19650, scored 7.1, involves a cross-site request forgery weakness in how GitLab’s GraphQL “multiplex” query handler processes requests. Because of insufficient validation, an attacker could trigger data-changing operations through what looks like an ordinary GET request, the kind of request a browser sends just by loading a page or an image.
The flaws affect self-managed installations of GitLab Community Edition and Enterprise Edition running versions 18.2 up through 19.2, before the patched releases. GitLab has shipped fixes in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4. Organizations on the 18.2 through 18.10 branches do not have a direct patch and instead need to upgrade to one of the fixed branches entirely. GitLab.com, the company’s own cloud-hosted service, and GitLab Dedicated instances were already updated before the advisory went public, so the exposure applies specifically to organizations running GitLab on their own infrastructure.
GitLab said it has seen no evidence that either vulnerability has been exploited in the wild, and no public proof-of-concept code has surfaced as of this writing. The vulnerability was reported through GitLab’s bug bounty program on HackerOne by a researcher using the handle hiimguardian. In keeping with its usual disclosure policy, GitLab is holding back the full technical write-up of how the bug works for roughly 90 days after the patch, giving administrators time to update before more details become public. That means a fuller technical breakdown is expected around mid-November 2026.
For a platform as widely used as GitLab, a flaw that requires no authentication to trigger data loss is a serious matter even without confirmed exploitation, since public proof-of-concept code often follows once security researchers reverse-engineer a patch. Security teams running self-managed GitLab should treat this as a priority update rather than something to schedule for a routine maintenance window.
Source: The Hacker News, “Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects”, with additional details from Security Affairs.
