Critical GitLab GraphQL Flaw (CVE-2026-19478) Allows Unauthenticated Deletion of Public Projects

Technical Details

The issue resides in GitLab's GraphQL API layer. A crafted GraphQL directive can be sent to a vulnerable instance without any credentials or user interaction, triggering a code-injection path that ultimately executes destructive operations on public projects. The attack vector works over the network (AV:N), requires low complexity (AC:L), and impacts integrity (I:H) and availability (A:H) while confidentiality impact is low (C:L). The flaw affects all self-managed Community Edition (CE) and Enterprise Edition (EE) versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.

SecurityAffairs

Impact

Successful exploitation enables an attacker to:

• Delete public repositories, removing source code, CI/CD pipelines, and release artifacts.
• Modify project metadata, potentially injecting malicious files or altering permissions.
• Exfiltrate or corrupt user data stored within public projects.

Because no authentication is required, any internet-facing GitLab instance is at risk. Automated scanners can probe for the vulnerable GraphQL endpoint, making large-scale exploitation feasible.

Rescana

Affected Versions & Patch Release

GitLab patched the issue on August 17, 2026 and released the following patched versions:

• 19.2.4
• 19.1.6
• 19.0.8
• 18.11.11

Self-managed deployments must upgrade immediately. GitLab.com and GitLab Dedicated are already on the patched versions and require no action. No new database migrations are required, and multi-node clusters should not experience downtime.

Tech Times

Mitigation & Recommendations

1. Upgrade all self-managed GitLab instances to the latest patched version (18.11.11, 19.0.8, 19.1.6, or 19.2.4) immediately.
2. Restrict external access to the GraphQL endpoint (/api/graphql) using firewall rules or a reverse-proxy that enforces authentication for public-facing services.
3. Monitor audit logs for unexpected project deletions or modifications. Look for GraphQL mutation activity without an authenticated session.
4. Apply any future security updates promptly; consider enabling GitLab’s auto-update channel for critical patches.
5. Review and reduce the exposure of public projects where possible, moving sensitive repositories to private visibility.

References

• The Hacker News – Critical GitLab GraphQL Flaw
• SecurityAffairs – GitLab Patches Critical Unauthenticated GraphQL Vulnerability
• Rescana – CVE-2026-19478 Analysis
• Tech Times – GitLab Emergency Patch