A critical security vulnerability in GitLab, tracked as CVE-2026-19478 with a CVSS score of 9.4, has come under active exploitation within days of its public disclosure. The flaw is a code injection vulnerability that allows unauthenticated attackers to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions. The exploitation activity was reported by watchTowr. The severity of the vulnerability is underscored by the fact that no authentication is required to exploit it, making it accessible to a wide range of threat actors. The rapid weaponization of this vulnerability highlights the ongoing challenge organizations face in patching critical flaws before attackers can leverage them. GitLab users and administrators are urged to apply available patches immediately to mitigate potential damage.
CVE-2026-19478 is a code injection vulnerability in GitLab CE and EE with a CVSS score of 9.4. It allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite repository data without requiring credentials, user interaction, or special configuration. The vulnerability is exploitable via a GraphQL directive. Impact includes deletion of entire repositories, forging merge records to falsely indicate that fixes landed, and banning project maintainers. watchTowr was able to reproduce the vulnerability within minutes of its disclosure and observed in-the-wild exploitation against its honeypot network. AI-enabled attackers are noted to be compressing the time from disclosure to active exploitation.
1. Upgrade GitLab CE and EE to patched versions: 19.2.4, 19.1.6, 19.0.8, or 18.11.11 as applicable. 2. If immediate patching is not possible, restrict unauthenticated access to the '/api/graphql' endpoint. 3. As an additional mitigation, remove public repository access entirely. 4. Hunt through web logs for requests containing '@gl_introduced' to identify signs of probes or attempted exploitation. 5. Organizations running internet-facing self-hosted GitLab instances should prioritize upgrading immediately.
'@gl_introduced (string in web/GraphQL request logs indicating probes or attempted exploitation)
