Critical Git Lab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
Summary: GitLab released an out-of-band critical patch on August 17, 2026 for CVE-2026-19478, a GraphQL directive flaw rated CVSS 9.4 that could let an unauthenticated attacker remotely modify or delete public projects and user data on self-managed Community and Enterprise Edition installations. The release also fixed CVE-2026-19650, a High-rated CSRF weakness (CVSS 7.1) in the GraphQL multiplex query handler that requires user interaction, with fixes in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
Key Takeaway: The patch landed five days after a routine release with no critical issues and outside GitLab's twice-monthly schedule, and the fix does not extend to the 18.2 through 18.10 branches, which fall inside the affected range - so self-managed teams on those branches have no patched version to move to. GitLab has not named the GraphQL directive involved or the conditions required for exploitation, and technical details stay private until roughly mid-November 2026.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-19478CVE-2026-19650
- Related