GitLab has issued patches for a critical code injection vulnerability, CVE-2026-19478, which could allow unauthenticated attackers to modify or delete public projects and user data. The flaw, rated with a CVSS score of 9.4, affects both GitLab Community Edition (CE) and Enterprise Edition (EE).
The vulnerability is described as a code injection issue exploitable remotely through a GraphQL directive, requiring no authentication or user interaction. GitLab strongly recommends that all self-managed installations be upgraded immediately to patched versions.
Affected GitLab CE and EE versions include 18.2 through 18.11.10, 19.0 through 19.0.7, 19.1 through 19.1.5, and 19.2 through 19.2.3. The necessary fixes are available in GitLab versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
GitLab confirmed that its hosted services, GitLab.com and GitLab Dedicated, are already running the patched versions, meaning customers using these services do not need to take any action.
In addition to the critical flaw, GitLab also addressed CVE-2026-19650, a cross-site request forgery (CSRF) vulnerability with a CVSS score of 7.1. This issue, found in the GraphQL multiplex query handler, involves improper request validation that could enable an unauthenticated attacker to execute mutations via GET requests. However, exploitation of this CSRF vulnerability requires user interaction.
Both vulnerabilities were reported to GitLab through its HackerOne bug bounty program. The company emphasized its commitment to maintaining high security standards for all customer-facing aspects and data-hosting components of its platform.
