CVE-2026-19478

Published Aug 17, 2026

Last updated a month ago

graphql

API

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-19478 is a code injection vulnerability found in the GraphQL API of GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw allows remote, unauthenticated attackers to send specially crafted GraphQL directives to vulnerable instances. The successful exploitation of this vulnerability can lead to the modification or deletion of public projects and associated user data. The attack requires no authentication or user interaction, making it straightforward for any actor with network access to the target instance to exploit. The vulnerability affects self-managed GitLab CE/EE versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. GitLab released patches on August 17, 2026, with fixes available in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. GitLab.com and GitLab Dedicated instances are not affected, as they were already patched. The vulnerability was responsibly disclosed by security researcher hiimguardian through the HackerOne bug bounty program.

Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
Source: cve@gitlab.com
NVD status: Analyzed
Products: gitlab

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Severity: CRITICAL

Weaknesses

cve@gitlab.com: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "D528B105-3DE1-471D-9623-F491A9F0D8C8",
            "versionEndExcluding": "18.11.11",
            "versionStartIncluding": "18.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "6CD95576-AC3B-4921-A002-72BD47579B77",
            "versionEndExcluding": "18.11.11",
            "versionStartIncluding": "18.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "C5EDDC0D-4D7B-4B69-A6F4-DA5A3A3C4638",
            "versionEndExcluding": "19.0.8",
            "versionStartIncluding": "19.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "A6B9C822-A303-486D-8787-73BA8A82C58B",
            "versionEndExcluding": "19.0.8",
            "versionStartIncluding": "19.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "7BB02223-1F27-4183-840A-0AAC4F6F2A5C",
            "versionEndExcluding": "19.1.6",
            "versionStartIncluding": "19.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "99D8510B-7BB5-4405-A3E6-D030BD420349",
            "versionEndExcluding": "19.1.6",
            "versionStartIncluding": "19.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "4D5485F8-E798-4A6B-B1C4-873D0DD58D8C",
            "versionEndExcluding": "19.2.4",
            "versionStartIncluding": "19.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "F92746EA-6152-4A7C-8509-4A94DF041B94",
            "versionEndExcluding": "19.2.4",
            "versionStartIncluding": "19.2.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.