Full Report
GitLab has patched two security flaws, including CVE-2026-19478, a critical code injection vulnerability that could allow unauthenticated attackers to remotely modify or delete public projects and user data. The disclosure adds to the growing list of GitLab vulnerabilities requiring prompt attention from organizations running self-managed instances. GitLab has released versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11 for Community Edition (CE) and Enterprise Edition (EE). The company described the releases as containing important bug and security fixes and strongly recommended that affected self-managed installations be upgraded immediately. CVE-2026-19478 Among Critical GitLab Vulnerabilities Tracked as CVE-2026-19478, the critical code injection flaw has a CVSS score of 9.4. Under certain conditions, an unauthenticated attacker could exploit a GraphQL directive to remotely modify or delete public projects and user data. The vulnerability affects GitLab CE/EE versions 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. Its CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. GitLab credited hiimguardian with reporting CVE-2026-19478 through its HackerOne bug bounty program. The company did not state that the vulnerability had been exploited in the wild. CVE-2026-19650 Impacts GraphQL The second issue, CVE-2026-19650, is a high-severity cross-site request forgery (CSRF) vulnerability affecting GitLab’s GraphQL multiplex query handler. It carries a CVSS score of 7.1. According to GitLab, the flaw could, under certain conditions, allow an unauthenticated user to execute mutations through GET requests because of improper request validation during GraphQL multiplex query handling. The issue affects the same GitLab CE/EE version ranges as CVE-2026-19478. Its CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L. GitLab credited Kreep with reporting the vulnerability through its HackerOne bug bounty program. GitLab Releases Security Updates The patched versions address both vulnerabilities across affected deployment types, including Omnibus, source code and Helm chart installations unless otherwise specified. GitLab said the releases introduce no new migrations and should not require downtime for multi-node deployments. However, Omnibus packages normally stop the service, run migrations, and restart it during updates, regardless of the size of the upgrade. Administrators can change this behavior for updates by creating the /etc/gitlab/skip-auto-reconfigure file. GitLab.com and GitLab Dedicated were already running the patched versions, meaning customers using those services did not need to take action. Organizations Urged to Upgrade GitLab recommended that installations running affected versions be upgraded to the latest patch release as soon as possible. The company also said its security fixes are released through scheduled and ad-hoc patch releases, with scheduled releases issued twice monthly on the second and fourth Wednesdays. GitLab stated that details of vulnerabilities are made public on its issue tracker 90 days after the release in which they are patched. The disclosure of CVE-2026-19478 and CVE-2026-19650 highlights the security risks associated with outdated installations and reinforces the need for timely patching against emerging GitLab vulnerabilities.
Analysis Summary