Critical GitLab GraphQL Vulnerability Allows Remote Deletion of Projects

Critical GitLab GraphQL Vulnerability Allows Remote Deletion of Projects

First seen 18 Aug 2026, 09:05 UTC •ThehackernewsRescanaSecurityaffairs.Codocs.gitlab.com •83% similarity •72.0

Article Content

Browse articles
ThreatCluster

A critical vulnerability, CVE-2026-19478, was discovered in GitLab CE/EE, enabling unauthenticated attackers to remotely delete or modify public projects and user data via a malicious GraphQL directive. Rated CVSS 9.4 (Critical), this flaw affects all self-managed GitLab installations from versions 18.2 to 19.2.4. GitLab released patches on August 17, 2026, and strongly advises immediate upgrades to mitigate risks. As of August 18, 2026, there are no confirmed reports of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability was disclosed by a researcher through the HackerOne bug bounty program, highlighting the need for organizations to act swiftly to protect their data.

Key Points: • CVE-2026-19478 allows unauthenticated remote deletion of public projects in GitLab. • GitLab released critical patches on August 17, 2026, for affected versions. • No confirmed exploitation has been reported as of August 18, 2026.

ThreatCluster AI How this analysis works

Timeline

2026-08-17
CVE-2026-19478 published
GitLab disclosed a critical GraphQL vulnerability allowing unauthenticated access to modify or delete public projects.
Rescana
2026-08-17
Patches released for GitLab CE/EE
GitLab released versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11 to address CVE-2026-19478.
docs.gitlab.com
2026-08-18
No confirmed exploitation reported
As of today, there are no reports of exploitation of CVE-2026-19478 in the wild.
Rescana

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

Gitlab GraphQL