Vulnerabilities · 49 days ago
GitLab Exploitation Turns Repo History Into a Target GitLab said on August 17 that it had fixed CVE-2026-19478 in Community Edition and Enterprise Edition, and WatchTowr says it saw the first in-the-wild exploitation attempts within about two days of disclosure. The bug affects self-managed GitLab 18.11.11 , 19.0.8 , 19.1.6 , and 19.2.4 .
The flaw sits in GraphQL: a normal-looking unauthenticated request can be accepted as a project action, letting an attacker modify or delete public project state, rewrite repositories, or forge merge records. That makes this more than a service issue; tampered history can look like ordinary GitLab activity, so logs may not tell you that the record itself has been poisoned.
For teams that use GitLab as a source of truth for public code or release pipelines, the exposure does not end when the patch lands. If an instance was hit, repository state, merge history, and downstream release provenance may all need separate trust checks because the attacker can alter the evidence, not just the app.
CVE-2026-19478 NVD KEV
CVSS 9.4 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8…
Timeline Sources 9 sources covering this story
The Hacker News Aug 24
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
AI-powered PLC attacks, GitLab exploits, npm backdoors, cloud leaks, auth abuse, and payment fraud lead this week’s cybersecurity recap.
The Hacker News Aug 21
GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure
GitLab CVE-2026-19478 is under active exploitation, with unauthenticated attacks able to modify or delete public projects under certain conditions.
SecurityWeek Aug 20
Critical GitLab Flaw Exploited Shortly After Disclosure
CVE-2026-19478 can be exploited without authentication to modify or delete public projects and user data.
Dark Reading Aug 18
Critical GitLab Zero-Click Flaw Poses Mitigation Challenges
A lack of technical details could make it hard for organizations running self-managed GitLab versions to detect potential exploitation of CVE-2026-19478.
CSO Online Aug 18
Critical GitLab flaw allows attackers to delete and modify public repos
Attackers don’t need credentials or user interaction to exploit the flaw which could enable supply chain attacks in self-hosted code repositories.
Help Net Security Aug 18
Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478) - Help Net Security
GitLab has patched a critical, unauthenticated code injection flaw (CVE-2026-19478) that let attackers delete public projects and user data.
Cybersecurity Dive Aug 18
GitLab issues emergency patch for critical code-injection flaw
Researchers warn that unauthenticated attackers would be able to delete or modify publicly accessible projects.
SecurityWeek Aug 18
GitLab Patches Critical Code Injection Vulnerability
The security defect allows unauthenticated attackers to modify or delete user data and public projects.
CSIRT Italia / ACN Aug 18
Rilevate vulnerabilità in GitLab
Rilevate due vulnerabilità di sicurezza, di cui una con gravità "critica" e una con gravità "alta", che interessano GitLab Community Edition (CE) e GitLab Enterprise Edition (EE).
NCSC-NL Advisories Aug 18
Kwetsbaarheden verholpen in GitLab door GitLab Inc. Revisies
heeft kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE).
INCIBE-CERT Aug 18
Múltiples vulnerabilidades en GitLab
GitLab ha publicado 2 vulnerabilidades: 1 de severidad crítica y 1 de severidad alta, que afectan a Gi
The Hacker News Aug 18
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab patches CVE-2026-19478, a CVSS 9.4 GraphQL flaw that could let unauthenticated attackers modify or delete public project and user data
Entities Part of the PlainSec briefing for 2026-08-25
Editions Related stories Vulnerabilities · 49 days ago
GitLab Exploitation Turns Repo History Into a Target GitLab said on August 17 that it had fixed CVE-2026-19478 in Community Edition and Enterprise Edition, and WatchTowr says it saw the first in-the-wild exploitation attempts within about two days of disclosure. The bug affects self-managed GitLab 18.11.11 , 19.0.8 , 19.1.6 , and 19.2.4 .
The flaw sits in GraphQL: a normal-looking unauthenticated request can be accepted as a project action, letting an attacker modify or delete public project state, rewrite repositories, or forge merge records. That makes this more than a service issue; tampered history can look like ordinary GitLab activity, so logs may not tell you that the record itself has been poisoned.
For teams that use GitLab as a source of truth for public code or release pipelines, the exposure does not end when the patch lands. If an instance was hit, repository state, merge history, and downstream release provenance may all need separate trust checks because the attacker can alter the evidence, not just the app.
CVE-2026-19478 NVD KEV
CVSS 9.4 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8…
Timeline Sources 9 sources covering this story
The Hacker News Aug 24
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
AI-powered PLC attacks, GitLab exploits, npm backdoors, cloud leaks, auth abuse, and payment fraud lead this week’s cybersecurity recap.
The Hacker News Aug 21
GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure
GitLab CVE-2026-19478 is under active exploitation, with unauthenticated attacks able to modify or delete public projects under certain conditions.
SecurityWeek Aug 20
Critical GitLab Flaw Exploited Shortly After Disclosure
CVE-2026-19478 can be exploited without authentication to modify or delete public projects and user data.
Dark Reading Aug 18
Critical GitLab Zero-Click Flaw Poses Mitigation Challenges
A lack of technical details could make it hard for organizations running self-managed GitLab versions to detect potential exploitation of CVE-2026-19478.
CSO Online Aug 18
Critical GitLab flaw allows attackers to delete and modify public repos
Attackers don’t need credentials or user interaction to exploit the flaw which could enable supply chain attacks in self-hosted code repositories.
Help Net Security Aug 18
Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478) - Help Net Security
GitLab has patched a critical, unauthenticated code injection flaw (CVE-2026-19478) that let attackers delete public projects and user data.
Cybersecurity Dive Aug 18
GitLab issues emergency patch for critical code-injection flaw
Researchers warn that unauthenticated attackers would be able to delete or modify publicly accessible projects.
SecurityWeek Aug 18
GitLab Patches Critical Code Injection Vulnerability
The security defect allows unauthenticated attackers to modify or delete user data and public projects.
CSIRT Italia / ACN Aug 18
Rilevate vulnerabilità in GitLab
Rilevate due vulnerabilità di sicurezza, di cui una con gravità "critica" e una con gravità "alta", che interessano GitLab Community Edition (CE) e GitLab Enterprise Edition (EE).
NCSC-NL Advisories Aug 18
Kwetsbaarheden verholpen in GitLab door GitLab Inc. Revisies
heeft kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE).
INCIBE-CERT Aug 18
Múltiples vulnerabilidades en GitLab
GitLab ha publicado 2 vulnerabilidades: 1 de severidad crítica y 1 de severidad alta, que afectan a Gi
The Hacker News Aug 18
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab patches CVE-2026-19478, a CVSS 9.4 GraphQL flaw that could let unauthenticated attackers modify or delete public project and user data
Entities Part of the PlainSec briefing for 2026-08-25
Editions Related stories