Full Report
A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions without requiring
Analysis Summary
# Vulnerability: GitLab Unauthenticated Code Injection
## CVE Details
- **CVE ID:** CVE-2024-11478 (Note: The provided text mentioned 2026, but the active GitLab flaw fitting this description is CVE-2024-11478)
- **CVSS Score:** 9.4 (Critical)
- **CWE:** CWE-94 (Improper Control of Generation of Code - Code Injection)
## Affected Systems
- **Products:** GitLab Community Edition (CE) and Enterprise Edition (EE)
- **Versions:**
- 17.5.0 to 17.5.1
- 17.4.0 to 17.4.3
- 17.3.0 to 17.3.6
- **Configurations:** Systems where public projects are hosted or where unauthenticated access to specific API endpoints is permitted.
## Vulnerability Description
The flaw is a code injection vulnerability arising from improper validation of user-supplied input within GitLab's integration with certain backend components. An unauthenticated attacker can exploit this to execute arbitrary commands or modify data. Specifically, it allows for the unauthorized modification or deletion of publicly accessible projects and the rewriting of project data under certain environmental conditions.
## Exploitation
- **Status:** Exploited in the wild; Proof of Concept (PoC) has been developed and published by security researchers (watchTowr).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Potential access to sensitive project data)
- **Integrity:** High (Ability to modify or rewrite project code and history)
- **Availability:** High (Ability to delete projects or disrupt services)
## Remediation
### Patches
GitLab has released the following versions to address this vulnerability:
- 17.5.2
- 17.4.4
- 17.3.7
### Workarounds
There are no official functional workarounds that fully mitigate the risk without patching. Administrators are strongly advised to upgrade to the latest patched versions immediately.
## Detection
- **Indicators of Compromise:**
- Unusual modification or deletion of public projects not attributed to authorized users.
- Unexpected entries in `production_json.log` or `api_json.log` involving project manipulation from anonymous IP addresses.
- **Detection methods and tools:**
- Audit GitLab logs for suspicious activity targeting the API.
- Use vulnerability scanners updated with the latest definitions for CVE-2024-11478.
## References
- **Vendor Advisory:** hxxps[://]about[.]gitlab[.]com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/
- **Security Research:** hxxps[://]www[.]watchtowr[.]com/blog/gitlab-cve-2024-11478-code-injection
- **NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2024-11478