Critical GitLab Vulnerability CVE-2026-19478 Comes Under Exploitation Within Days

watchTowr has reported that a recently disclosed GitLab vulnerability is already under active exploitation — attacks were observed within days of publication.

The flaw in question is CVE-2026-19478 (CVSS score 9.4), a code injection that, under certain conditions, allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and overwrite their data. No credentials, no user interaction and no exotic configuration are required.

What's affected

The issue affects Community Edition (CE) and Enterprise Edition (EE) in the following versions: 18.2 through 18.11.11, 19.0 through 19.0.8, 19.1 through 19.1.6 and 19.2 through 19.2.4. According to GitLab, the vulnerability is exploited through a GraphQL directive. Fixes were released in versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11.

The scope of the impact, watchTowr says, goes well beyond simply deleting public projects: an attacker can wipe out entire repositories, forge merge records to make it look as though a fix was applied (when in reality it wasn't), and lock out project maintainers.

Speed favors the attackers

watchTowr's researchers said they were able to reproduce the vulnerability within literally minutes of its disclosure, and then observed exploitation attempts against their honeypot network. The company's principal researcher, Jake Knott, attributes this to a new reality: attackers armed with AI are compressing the gap between disclosure and attack down to nearly zero, and the familiar tactic of “waiting until the next update cycle” now often turns out to be too late.

For those who haven't yet applied the patch, Knott advises reviewing web logs for requests containing the string @gl_introduced — a sign of probing or an attempted exploit.

What to do

Organizations running internet-facing self-hosted GitLab installations are urged to prioritize upgrading to a patched version. If prompt patching isn't feasible, the suggested stopgap is to restrict unauthenticated access to /api/graphql or disable public repository access altogether.

Source: The Hacker News