452/69 Thursday, August 20, 2026
GitLab has released patches to fix a Critical vulnerability, CVE-2026-19478, with a CVSS score of 9.4. The vulnerability could allow unauthenticated attackers to modify or delete public projects and user data through GraphQL directives under certain conditions. The flaw affects only self-managed installations. GitLab recommends that administrators update to versions 19.2.4, 19.1.6, 19.0.8, or 18.11.11 as soon as possible. The vulnerability was reported through GitLab’s bug bounty program on HackerOne.
GitLab released the patch on August 17, 2026, only five days after its regular scheduled update. Administrators using certain older versions should note that the released patches do not cover branches 18.2 through 18.10, even though these versions are within the affected range. Organizations still running these versions should upgrade to a fixed branch rather than waiting for patches for their current version. In the same release, GitLab also fixed another vulnerability, CVE-2026-19650, with a CVSS score of 7.1. This is a Cross-Site Request Forgery (CSRF) vulnerability related to the handling of GraphQL multiplex queries, which could allow unauthenticated attackers to trigger mutations through GET requests due to improper validation. However, this flaw requires user interaction, making it less severe than the primary vulnerability.
At the time of reporting, there was no evidence that either vulnerability had been actively exploited, and no public proof-of-concept had been released. However, organizations using self-managed GitLab instances should prioritize patching, as CVE-2026-19478 is Critical, requires no credentials, and does not require user interaction. In addition, under GitLab’s disclosure policy, technical details of vulnerabilities are typically published on the issue tracker about 90 days after patches are released. This may provide threat actors with more information to develop exploits later, especially as GitLab recently had another case involving a remote code execution vulnerability in self-managed servers, for which exploit code was published the previous month.