Unauth GraphQL path can rewrite public projects
According to The Hacker News, CVE-2026-19478 is a 9.4-severity GitLab code-injection flaw that can let an unauthenticated attacker modify or delete publicly accessible projects and rewrite their data without credentials, user interaction, or unusual configuration.
GitLab says the vulnerable path can be reached through a GraphQL directive. That matters. GitLab is more than a code host. For many organizations it sits in the release and review path, and in the audit trail teams use to decide what is trustworthy.
Why The Timing Matters
watchTowr told The Hacker News it reproduced the issue within minutes of disclosure and then observed in-the-wild exploitation against its honeypot network. That is the real signal. The gap between disclosure and exploitation has compressed enough that routine patch cadence is often already late.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Deleting a public repository is only part of it. The same reporting says an attacker could forge merge records to make it appear a fix landed when it did not, or even ban project maintainers. That hits both availability and integrity.
Affected And Fixed Versions
The affected GitLab CE and EE releases include 18.11 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.
Fixes are available in GitLab CE and EE versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4. Internet-facing self-hosted instances should be treated as the highest-priority lane.
Upgrade, hunt @gl_introduced, check project integrity
Treat this as software-trust protection, not only infrastructure patching.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
- Upgrade every self-hosted GitLab instance to a fixed release as quickly as possible.
- Hunt web logs for requests containing
@gl_introduced, which watchTowr called out as a useful probe or exploitation clue. - If patching cannot happen immediately, restrict unauthenticated access to
/api/graphqlor remove public repository exposure as a temporary mitigation. - Review public project integrity and merge history. Check maintainer state for signs that repositories were altered rather than only scanned.
- Brief engineering leadership because this is a release-integrity issue as much as a vulnerability-management issue.
Sources
CyberExperts used The Hacker News as the primary source for this article and kept the coverage anchored to the details defenders need: CVE-2026-19478, the GraphQL attack path, the affected and fixed GitLab versions, and the active-exploitation signal. It also kept the specific log and mitigation guidance tied to public instances.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Thursday’s brief: Fortinet’s firewall fixes land today, then Cisco Expressway, eMudhra certificates and PHP2Shell
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
