GitLab has confirmed that a critical vulnerability in its GraphQL API, identified as CVE-2026-19478, is being actively exploited in the wild. The flaw, which carries a CVSS score of 9.4, allows unauthenticated attackers to remotely modify or delete public projects and associated user data on self-managed GitLab instances.
The company issued an emergency patch on August 17, five days after its regular update cycle, to address the vulnerability. This followed a report by hiimguardian through GitLab's HackerOne bug bounty program.
According to GitLab's advisory, the issue could allow an unauthenticated user to manipulate public projects and user data via a GraphQL directive under specific conditions. WatchTowr researchers have also warned of the active exploitation of this critical flaw.
The vulnerability affects self-managed GitLab installations. Users are urged to upgrade to versions 19.2.4, 19.1.6, 19.0.8, or 18.11.11. It is important to note that patches are not available for versions 18.2 through 18.10, despite these versions falling within the affected range. Organizations running these older versions must upgrade to a currently supported and patched branch.
For organizations unable to immediately apply the patches, temporary mitigation strategies include restricting unauthenticated access to the `/api/graphql` endpoint and disabling public repositories where feasible. Administrators should also review their logs for requests containing the string `@gl_introduced`, which may indicate attempted exploitation.
