Critical code injection vulnerability in GitLab CE/EE with available proof-of-concept, Patch ...

On 17 August 2026, GitLab published a security advisory a critical vulnerability affecting multiple versions of GitLab CE/EE. Successful exploitation of this vulnerability could lead to unauthorized data modification.

There is publicly available proof-of-concept as of the 18th August 2026 while there is no available proof of active exploitation.

Exploiting it could have a high impact on the Integrity and the Availability of the affected system but no impact on the system's Confidentiality.

An unauthenticated, network-based attacker without any user interaction and without any high-privilege role can exploit this flaw in the GraphQL to weaponise directives to modify and/or delete public projects without proper authorization and modify/delete users' data.

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing. Visit the vendor's advisory for details.

Please update to versions 19.2.4, 19.1.6, 19.0.8, 18.11.11 or later.

The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion.

In case of an intrusion, you can report an incident via .

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.