GitLab issues urgent fixes for critical unauthenticated GraphQL bug

Critical GitLab flaw affects self-managed installations

GitLab has released out-of-band security updates for CVE-2026-19478, a critical vulnerability in GitLab Community Edition and Enterprise Edition. Rated 9.4 on the CVSS scale, the flaw could, under certain conditions, allow an unauthenticated remote attacker to modify or delete public projects and user data.

The company issued the release on August 17, 2026, five days after a routine update that contained no critical-rated issues. GitLab normally publishes security updates twice a month, on the second and fourth Wednesdays, making this release an exception to its standard schedule.

Only self-managed deployments require action. GitLab.com and GitLab Dedicated are already operating on a patched version, and their customers do not need to take action.

Versions to upgrade and unsupported branches

GitLab has delivered fixes in versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11. The affected ranges are all releases from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.

The 18.2 through 18.10 branches are within the affected range but do not receive these fixes. Organisations running those branches need to plan a move to a supported release rather than wait for a patch on their current branch.

GitLab said the issue involves a GraphQL directive, but did not identify the directive or the conditions needed for exploitation. Its published CVSS vector indicates network-based exploitation without credentials or victim interaction. The advisory did not report active exploitation, and no public proof-of-concept code had appeared on GitHub as of August 18.

A second GraphQL issue is also fixed

The release also resolves CVE-2026-19650, a high-severity CSRF vulnerability scored at 7.1. It could, under certain conditions, allow an unauthenticated user to execute mutations through GET requests because of improper request validation in GraphQL multiplex query handling. Unlike the critical issue, this attack requires user interaction.

The GraphQL exposure follows a broader pattern of DevOps platform security concerns, including Cisco vulnerabilities, ClickFix chains and AI agent incidents and its account of vulnerabilities affecting Cisco systems, ClickFix chains and AI agent incidents. GitLab said the update introduces no new migrations and is not expected to cause downtime on multi-node deployments.

Operational implication

GitLab plans to publish issue-tracker details 90 days after the patch release, placing further technical information for these flaws around mid-November 2026. Security and platform teams should inventory self-managed GitLab instances, upgrade supported versions to the specified releases, and prioritise migration from the unsupported 18.2–18.10 branches.