GitLab patches critical GraphQL flaw that lets attackers delete projects without logging in

GitLab has shipped an emergency security patch for a critical vulnerability that lets unauthenticated attackers remotely delete or modify public projects and user data — no credentials, no user interaction, no prerequisites. The flaw, tracked as CVE-2026-19478 with a CVSS score of 9.4, affects both the Community and Enterprise editions across a wide range of versions.

The fix arrived on August 17, 2026, and self-managed GitLab administrators should treat it as urgent. GitLab.com and GitLab Dedicated are already patched and not at risk.

The vulnerability: code injection in a GraphQL directive

The flaw lives in a GraphQL directive handling layer within GitLab's API. An attacker can craft a malicious GraphQL request that, when processed, executes code with enough privilege to modify or delete public project data and associated user records. GitLab confirmed that "under certain conditions," an unauthenticated user can "remotely modify or delete public projects and user data via a GraphQL directive."

A second vulnerability was patched at the same time: CVE-2026-19650 (CVSS 7.1), a cross-site request forgery weakness in GitLab's GraphQL multiplex query handler. This one allows execution of mutations via GET requests — but requires user interaction, making it significantly less dangerous than the primary flaw.

Affected and patched versions

The vulnerability affects GitLab CE and EE versions 18.2 through 18.11.10, 19.0 through 19.0.7, 19.1 through 19.1.5, and 19.2 through 19.2.3. Administrators should upgrade to 19.2.4, 19.1.6, 19.0.8, or 18.11.11 — whichever matches their current branch — immediately.

The third GraphQL critical of 2026

CVE-2026-19478 is the third critical vulnerability GitLab has patched at the GraphQL layer this year. That pattern points to a sustained hardening problem in the platform's core API surface. GraphQL's flexibility — particularly around directives and query composition — creates complex trust boundaries that are difficult to audit exhaustively, and GitLab appears to be working through them one emergency patch at a time.

As of August 18, 2026, no public proof-of-concept exploit has been confirmed, and GitLab plans to release full technical details in November 2026. That window gives administrators time to patch — but the absence of public exploits won't last indefinitely once disclosure happens.

The vulnerability was reported by The Hacker News and Help Net Security on August 18, 2026.