GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure

What The Flaw Allows

According to The Hacker News, CVE-2026-19478 is a 9.4-severity GitLab code-injection flaw that can let an unauthenticated attacker modify or delete publicly accessible projects and rewrite their data without credentials, user interaction, or unusual configuration.

GitLab says the vulnerable path can be reached through a GraphQL directive. That matters because GitLab is not just a code host. For many organizations it is part of the release, review, and audit trail that teams rely on to decide what is trustworthy.

Why The Timing Matters

watchTowr told The Hacker News it reproduced the issue within minutes of disclosure and then observed in-the-wild exploitation against its honeypot network. That is the real signal. The gap between disclosure and exploitation has compressed enough that routine patch cadence is often already late.

The attacker's leverage here is not limited to deleting a public repository. The same reporting says an attacker could forge merge records to make it appear a fix landed when it did not, or even ban project maintainers. That turns the issue into both an availability problem and an integrity problem.

Affected And Fixed Versions

The affected GitLab CE and EE releases include 18.11 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.

Fixes are available in GitLab CE and EE versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4. Internet-facing self-hosted instances should be treated as the highest-priority lane.

What Teams Should Do Next

Treat this as software-trust protection, not only infrastructure patching.

• Upgrade every self-hosted GitLab instance to a fixed release as quickly as possible.
• Hunt web logs for requests containing @gl_introduced, which watchTowr called out as a useful probe or exploitation clue.
• If patching cannot happen immediately, restrict unauthenticated access to /api/graphql or remove public repository exposure as a temporary mitigation.
• Review public project integrity, merge history, and maintainer state for signs that repositories were altered rather than only scanned.
• Brief engineering leadership because this is a release-integrity issue as much as a vulnerability-management issue.

Source Context

CyberExperts used The Hacker News as the primary source for this article and kept the coverage anchored to the details defenders need: CVE-2026-19478, the GraphQL attack path, the affected and fixed GitLab versions, the active-exploitation signal, and the specific log and mitigation guidance tied to public instances.

Related In The Daily Brief

See this item in The 5-Minute Cyber Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].

Keep Reading

Explore more →

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Attackers began exploiting SharePoint auth bypass CVE-2026-55040 after Rapid7 released a PoC; KEVIntel saw eight of 12 attempts on August…

CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws

CISA is telling federal agencies to move within three days on actively exploited flaws in IBM Langflow, N-able N-central, and…

The 5-Minute Cyber Brief: August 11, 2026

CISA ties SharePoint CVE-2026-45659 to ransomware, LoadMaster joins KEV, OpenAI launches GPT-5.6-Cyber, the ChainDrop npm worm, and a joint advisory…