GITLAB has issued an out‑of‑band patch for a critical unauthenticated GraphQL injection flaw that lets remote actors modify or delete public projects on self‑managed servers. SecurityAffairs reports the vulnerability as CVE‑2026-19478.
The flaw carries a CVSS score of 9.4 and resides in the GraphQL API where a specially crafted directive can be injected without authentication. SecurityWeek notes that successful exploitation enables alteration or removal of any public project accessible via the instance. Versions prior to 19.2.4 are affected, covering all Community and Enterprise Editions from 18.2 onward.
A companion issue, CVE‑2026-19650, is rated CVSS 7.1 and represents a CSRF weakness that requires a victim to interact with a malicious link before an unauthenticated mutation can be executed. SecurityOnline explains that this defect also impacts the same version range but poses a lower risk due to the interaction requirement.
Although no exploitation has been observed in the wild, the high severity of the GraphQL bug has prompted an urgent upgrade recommendation. The Hacker News highlights that the patches are included in releases 18.11.11, 19.0.8, 19.1.6 and 19.2.4. Users of GitLab.com do not need to act as the fixes were applied automatically to the SaaS offering.
Administrators of self‑managed GitLab instances should immediately consult the official release notes and upgrade to the latest patched version for their branch. GitLab’s patch announcement provides direct download links and verification steps. After upgrading, it is advisable to restart services and confirm that the GraphQL endpoint no longer accepts unauthenticated directive injections.
Security teams should review audit logs for unexpected GraphQL queries, especially those containing atypical directives, and enforce strict network segmentation to limit exposure of the API to trusted addresses. Ensuring that off‑site backups are current and tested will help recover quickly should any project data be altered or removed.