--- title: Critical GitLab flaw allows attackers to delete and... description: GitLab patched a critical unauthenticated code injection vulnerability (CVE-2026-19478) in its GraphQL directive that lets attackers rewrite repository state,... canonical: https://daily.dev/posts/critical-gitlab-flaw-allows-attackers-to-delete-and-modify-public-repos-qommfpydw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical GitLab flaw allows attackers to delete and modify public repos | daily.dev og:description: GitLab patched a critical unauthenticated code injection vulnerability (CVE-2026-19478) in its GraphQL directive that lets attackers rewrite repository state,... og:url: https://daily.dev/posts/critical-gitlab-flaw-allows-attackers-to-delete-and-modify-public-repos-qommfpydw og:image: https://api.daily.dev/og/posts/qoMMFpyDw.png og:image:alt: Critical GitLab flaw allows attackers to delete and modify public repos og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical GitLab flaw allows attackers to delete and modify public repos **[CSO Online](https://daily.dev/sources/csoonline)** · 2 min read · 0 upvotes · 0 comments ## Summary GitLab patched a critical unauthenticated code injection vulnerability (CVE-2026-19478) in its GraphQL directive that lets attackers rewrite repository state, forge merge records, ban maintainers, and delete entire projects without credentials or user interaction. A second high-risk CSRF flaw (CVE-2026-19650) in the GraphQL multiplex query handler was also fixed. Security firm watchTowr says the vulnerability is trivially reverse-engineerable from the patch. Fixed versions are 19.2.4, 19.1.6, 19.0.8, and 18.11.11 for both CE and EE. Users unable to patch immediately are advised to make repositories private and block unauthenticated access to /api/graphql. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-19478 in GitLab and how bad is it? CVE-2026-19478 is a critical code injection vulnerability in GitLab's GraphQL directive that lets unauthenticated attackers modify or delete public repositories with a single HTTP request. It requires no credentials, user interaction, or special configuration, and can be used to rewrite repository state, forge merge records, ban maintainers, and delete entire projects, enabling supply chain attacks on self-hosted instances. _daily.dev helps teams running self-hosted GitLab stay on top of critical CVEs like this one._ ### Which GitLab versions fix CVE-2026-19478 and CVE-2026-19650? GitLab released versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11 for both Community Edition and Enterprise Edition to fix CVE-2026-19478, a critical GraphQL code injection flaw, and CVE-2026-19650, a high-risk CSRF issue in the GraphQL multiplex query handler. Instances that cannot patch immediately should make repositories private and block unauthenticated access to /api/graphql. _Track which GitLab release actually closes this hole before scheduling your patch window via daily.dev._ ### How quickly can attackers exploit a disclosed GitLab GraphQL vulnerability like CVE-2026-19478? Very quickly. Security researchers at watchTowr reproduced the vulnerability within minutes of disclosure using only the advisory details and the patch itself, since comparing patched and unpatched code makes reverse-engineering the exploit straightforward, and researchers warn AI-enabled attackers could move just as fast. _Fast-moving exploits like this are why teams watch security disclosures closely on daily.dev._ ## Similar posts on daily.dev - [GitLab Patch Release: 19.0.2, 18.11.5, 18.10.8](https://daily.dev/posts/gitlab-patch-release-19-0-2-18-11-5-18-10-8-fmukjse7k) · GitLab · 0 upvotes · 0 comments - [Hackers now exploit critical Gitea flaw in code injection attacks](https://daily.dev/posts/hackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks-gmz4nkjzi) · BleepingComputer · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#graphql](https://daily.dev/tags/graphql), [#gitlab](https://daily.dev/tags/gitlab) [View this post on daily.dev](https://daily.dev/posts/critical-gitlab-flaw-allows-attackers-to-delete-and-modify-public-repos-qommfpydw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical GitLab flaw allows attackers to delete and modify public repos","url":"https://daily.dev/posts/critical-gitlab-flaw-allows-attackers-to-delete-and-modify-public-repos-qommfpydw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-gitlab-flaw-allows-attackers-to-delete-and-modify-public-repos-qommfpydw"},"datePublished":"2026-08-18T19:36:31.642Z","dateModified":"2026-08-24T08:13:33.694Z","description":"GitLab patched a critical unauthenticated code injection vulnerability (CVE-2026-19478) in its GraphQL directive that lets attackers rewrite repository state,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/70a8235b50c86434079f68532e3e70e3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/70a8235b50c86434079f68532e3e70e3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-gitlab-flaw-allows-attackers-to-delete-and-modify-public-repos-qommfpydw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,graphql,gitlab","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Critical GitLab flaw allows attackers to delete and modify public repos"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/critical-gitlab-flaw-allows-attackers-to-delete-and-modify-public-repos-qommfpydw#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-19478 in GitLab and how bad is it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-19478 is a critical code injection vulnerability in GitLab's GraphQL directive that lets unauthenticated attackers modify or delete public repositories with a single HTTP request. It requires no credentials, user interaction, or special configuration, and can be used to rewrite repository state, forge merge records, ban maintainers, and delete entire projects, enabling supply chain attacks on self-hosted instances. daily.dev helps teams running self-hosted GitLab stay on top of critical CVEs like this one."}},{"@type":"Question","name":"Which GitLab versions fix CVE-2026-19478 and CVE-2026-19650?","acceptedAnswer":{"@type":"Answer","text":"GitLab released versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11 for both Community Edition and Enterprise Edition to fix CVE-2026-19478, a critical GraphQL code injection flaw, and CVE-2026-19650, a high-risk CSRF issue in the GraphQL multiplex query handler. Instances that cannot patch immediately should make repositories private and block unauthenticated access to /api/graphql. Track which GitLab release actually closes this hole before scheduling your patch window via daily.dev."}},{"@type":"Question","name":"How quickly can attackers exploit a disclosed GitLab GraphQL vulnerability like CVE-2026-19478?","acceptedAnswer":{"@type":"Answer","text":"Very quickly. Security researchers at watchTowr reproduced the vulnerability within minutes of disclosure using only the advisory details and the patch itself, since comparing patched and unpatched code makes reverse-engineering the exploit straightforward, and researchers warn AI-enabled attackers could move just as fast. Fast-moving exploits like this are why teams watch security disclosures closely on daily.dev."}}]} ```