GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure
- ID
- 16354
- Status
- summarized
- Published
- 21 Aug 2026, 3:04 PM
- Fetched
- 21 Aug 2026, 4:21 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/gitlab-cve-2026-19478-comes-under.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.5
- Created
- 21 Aug 2026, 4:25 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
GitLab CVE-2026-19478 (CVSS 9.4), a code injection flaw exploitable via a GraphQL directive by unauthenticated attackers, is under active exploitation within days of disclosure. It affects self-hosted GitLab CE/EE versions 18.2 (before 18.11.11), 19.0 (before 19.0.8), 19.1 (before 19.1.6), and 19.2 (before 19.2.4). watchTowr reports attackers can delete repositories, forge merge records, and ban maintainers; they recommend hunting web logs for '@gl_introduced' and patching immediately or restricting unauthenticated access to /api/graphql.
Why it matters
If your team runs an internet-facing self-hosted GitLab instance on any affected version, patch to 19.2.4, 19.1.6, 19.0.8, or 18.11.11 now or restrict unauthenticated /api/graphql access — active exploitation is already happening. The compressed disclosure-to-exploit window (minutes, per watchTowr) means waiting for a normal patch cycle is no longer viable for internet-exposed dev infrastructure.
Discussion angle
How many Malaysian dev teams still run internet-facing self-hosted GitLab, and what's a realistic patch SLA when exploit-to-disclosure windows shrink to hours thanks to AI-assisted attackers?