Git Lab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure
Summary: GitLab disclosed CVE-2026-19478, a code injection flaw with a CVSS score of 9.4 that lets an unauthenticated attacker modify or delete publicly accessible GitLab projects and rewrite their data via a GraphQL directive, with fixes in GitLab CE and EE versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. watchTowr told The Hacker News it reproduced the vulnerability within minutes of disclosure and observed in-the-wild exploitation against its honeypot network.
Bottom line: watchTowr's Jake Knott attributes the compressed disclosure-to-exploitation window to AI-enabled attackers, and notes an attacker can delete entire repositories, forge merge records to make it appear a fix landed when it didn't, and ban project maintainers - so an unpatched, internet-facing instance can lose code integrity and its own audit trail, not just its public projects.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-19478
- Related