What The Flaw Allows
According to The Hacker News, CVE-2026-19478 is a 9.4-severity GitLab code-injection flaw that can let an unauthenticated attacker modify or delete publicly accessible projects and rewrite their data without credentials, user interaction, or unusual configuration.
GitLab says the vulnerable path can be reached through a GraphQL directive. That matters because GitLab is not just a code host. For many organizations it is part of the release, review, and audit trail that teams rely on to decide what is trustworthy.
Why The Timing Matters
watchTowr told The Hacker News it reproduced the issue within minutes of disclosure and then observed in-the-wild exploitation against its honeypot network. That is the real signal. The gap between disclosure and exploitation has compressed enough that routine patch cadence is often already late.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Free. Weekday mornings. Unsubscribe anytime.
Built from 100+ trusted cybersecurity sources.
The attacker's leverage here is not limited to deleting a public repository. The same reporting says an attacker could forge merge records to make it appear a fix landed when it did not, or even ban project maintainers. That turns the issue into both an availability problem and an integrity problem.
Affected And Fixed Versions
The affected GitLab CE and EE releases include 18.11 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.
Fixes are available in GitLab CE and EE versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4. Internet-facing self-hosted instances should be treated as the highest-priority lane.
What Teams Should Do Next
Treat this as software-trust protection, not only infrastructure patching.
- Upgrade every self-hosted GitLab instance to a fixed release as quickly as possible.
- Hunt web logs for requests containing
@gl_introduced, which watchTowr called out as a useful probe or exploitation clue. - If patching cannot happen immediately, restrict unauthenticated access to
/api/graphqlor remove public repository exposure as a temporary mitigation. - Review public project integrity, merge history, and maintainer state for signs that repositories were altered rather than only scanned.
- Brief engineering leadership because this is a release-integrity issue as much as a vulnerability-management issue.
Source Context
CyberExperts used The Hacker News as the primary source for this article and kept the coverage anchored to the details defenders need: CVE-2026-19478, the GraphQL attack path, the affected and fixed GitLab versions, the active-exploitation signal, and the specific log and mitigation guidance tied to public instances.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
