Vulnerabilities

Critical GitLab Vulnerability Under Active Attack — Patch Now

Critical GitLab vulnerability CVE-2026-19478 exploited; patch self-managed instances now to prevent unauthenticated code injection.

By Content Team

Aug 24, 2026

ON THIS PAGE

A critical GitLab vulnerability (CVE-2026-19478) is being actively exploited, and administrators of self-managed instances need to patch immediately. Rated 9.4/10, the flaw lets unauthenticated attackers inject code through GitLab's GraphQL interface — no account or user interaction required.

Attackers can delete repositories, manipulate merge records, and ban legitimate maintainers from public projects. Security firm WatchTowr reproduced the exploit within minutes of disclosure and confirmed its honeypot network recorded live exploitation attempts.

The vulnerability spans GitLab CE/EE versions 18.2 through 18.11.10, 19.0 through 19.0.7, 19.1 through 19.1.5, and 19.2 through 19.2.3. Patched builds (18.11.11, 19.0.8, 19.1.6, 19.2.4) are available now. GitLab.com and Dedicated users are already protected. If you can't upgrade immediately, restrict GraphQL endpoint access and treat exposed servers as potentially compromised.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?