The Hacker News reported that GitLab CVE-2026-19478 has come under active exploitation within days of disclosure.
The vulnerability is a code injection issue with a CVSS score of 9.4.
The flaw can allow unauthenticated attackers to modify or delete publicly accessible GitLab projects and rewrite project data under certain conditions.
Vulnerable GitLab Community Edition and Enterprise Edition builds include 18.2.0 through 18.11.10, 19.0.0 through 19.0.7, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.3.
Patched builds are 18.11.11, 19.0.8, 19.1.6, and 19.2.4.
GitLab said the flaw could be exploited through a GraphQL directive.
watchTowr said it reproduced the vulnerability within minutes of disclosure and observed exploitation against its honeypot network.
Researchers advised organizations to hunt web logs for requests containing @gl_introduced.
If immediate patching is not possible, organizations were advised to restrict unauthenticated access to /api/graphql or remove public repository access as a mitigation.
GitLab’s critical CVE-2026-19478 GraphQL code-injection flaw is under active exploitation, leaving self-managed instances exposed to unauthorized changes or deletion of public projects and user data. Administrators should patch immediately, review web logs for exploitation attempts, and verify repository integrity for unauthorized changes.
How CVE-2026-19478 Compromises GitLab Project Integrity
CVE-2026-19478 is a critical code-injection vulnerability exploitable through a GraphQL directive. Under specific conditions, an unauthenticated attacker can remotely modify or delete public projects and user data.
watchTowr reproduced the flaw within minutes using GitLab’s advisory and patch, then observed exploitation attempts against its honeypot network roughly two days after disclosure. This compressed timeline shows why internet-facing DevOps platforms require emergency patching rather than routine remediation.
Reported impact includes:
Deleting entire repositories
Forging merge records
Rewriting project data
Banning project maintainers
Affected and Patched Versions
Vulnerable builds: GitLab 18.2.0 through 18.11.10, 19.0.0 through 19.0.7, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.3
Patched builds: GitLab 18.11.11, 19.0.8, 19.1.6, and 19.2.4
Organizations running an affected GitLab CE or EE release should immediately upgrade to the applicable patched version for their release branch.
How XDR Platforms Unify Endpoint, Network, and Cloud Security
See how XDR unifies endpoint, network, and cloud telemetry for faster threat detection and response.
The Hexnode Solution
Hexnode UEM can apply device compliance policies to developer and administrator endpoints. These policies can evaluate encryption, password compliance, required or blocklisted applications, device activity, and management-profile status. Hexnode can also surface endpoint and user incidents associated with non-compliance, configuration gaps, location anomalies, and potential account misuse.
For organizations that federate GitLab through Microsoft Entra ID, Hexnode can operate as a compliance partner for Conditional Access. Administrators can require supported Windows 10/11, Android, iOS, and macOS 11+ devices to be marked compliant before accessing the protected application.
These controls strengthen the endpoint and identity boundary but do not patch GitLab, inspect GraphQL requests, or validate repository integrity. Organizations must still upgrade vulnerable GitLab instances and conduct platform-level log and integrity reviews.
Feature Resource
Cybersecurity kit
This resource kit will help your company adopt the right cybersecurity strategy to secure your business.
The rapid exploitation of CVE-2026-19478 shows why internet-facing DevOps platforms require emergency patching and continuous integrity monitoring. Enterprises should immediately update affected self-managed GitLab instances, preserve and review web logs, verify repository and merge-record integrity, and correlate source-control events with endpoint and identity telemetry.
Try Hexnode free for 14 days
Strengthen endpoint compliance and access control with Hexnode.
I’m a technical content writer at Hexnode who loves simplifying tech. I break down complex ideas, remove the fluff, and help readers clearly understand our product for what it actually is: simple, reliable, and built to solve real problems.
