GitLab releases security update for critical GraphQL flaw rated 9.4
This digest was compiled by AI from multiple sources — links to the originals are below.
GitLab released security updates on August 17 to address a critical vulnerability tracked as CVE-2026-19478 with a CVSS score of 9.4. The flaw could allow an unauthenticated attacker to remotely modify or delete public projects and user data via a GraphQL directive under certain conditions. GitLab.com and GitLab Dedicated already run patched versions, while only self-managed installations need to apply the fixes.
Key Facts
- CVE-2026-19478 carries a CVSS score of 9.4 and can be exploited over a network by an unauthenticated attacker with no user interaction to modify or delete public projects and user data.
- The fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11, and only self-managed installations need to apply them.
- Affected versions include all releases from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.
- The second flaw fixed, CVE-2026-19650, is rated High with a CVSS score of 7.1 and is a cross-site request forgery weakness in the GraphQL multiplex query handler.
- As of August 18, 2026, GitLab has disclosed no exploitation of either flaw and no public exploit code has appeared on GitHub.
Patch Details
GitLab released the update on August 17, 2026, outside its usual schedule of twice-monthly updates on the second and fourth Wednesdays. The release came five days after a routine patch release that carried no critical-rated issues. GitLab.com and GitLab Dedicated are already running the patched version, and their customers do not need to take action. The update introduces no new migrations and is not expected to require downtime on multi-node deployments.
Affected Versions
The fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11. All versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 are affected. The fixes do not extend to the 18.2 through 18.10 branches, which fall inside the affected range. GitLab has not named the GraphQL directive involved or specified the conditions necessary for exploitation. The CVSS vector published for the flaw indicates it can be exploited over a network by an attacker holding no credentials and without any action by a victim.
Second Vulnerability
CVE-2026-19650, rated High with a CVSS score of 7.1, concerns a cross-site request forgery weakness in the GraphQL multiplex query handler. Unlike the critical flaw, CVE-2026-19650 requires user interaction to work. GitLab said the issue could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling. No exploitation of either flaw and no public exploit code had surfaced on GitHub as of August 18, 2026. GitLab said technical details for both flaws will be made public on its issue tracker around mid-November 2026, after its 90-day disclosure window.
6 sources
GitLab releases security update for critical GraphQL flaw rated 9.4
