AI Weekly Malaysia

GitLab CVE-2026-19478 (CVSS 9.4), a code injection flaw exploitable via a GraphQL directive by unauthenticated attackers, is under active exploitation within days of disclosure. It affects self-hosted GitLab CE/EE versions 18.2 (before 18.11.11), 19.0 (before 19.0.8), 19.1 (before 19.1.6), and 19.2 (before 19.2.4). watchTowr reports attackers can delete repositories, forge merge records, and ban maintainers; they recommend hunting web logs for '@gl_introduced' and patching immediately or restricting unauthenticated access to /api/graphql.

Why: If your team runs an internet-facing self-hosted GitLab instance on any affected version, patch to 19.2.4, 19.1.6, 19.0.8, or 18.11.11 now or restrict unauthenticated /api/graphql access — active exploitation is already happening. The compressed disclosure-to-exploit window (minutes, per watchTowr) means waiting for a normal patch cycle is no longer viable for internet-exposed dev infrastructure.

GitLab issued an out-of-schedule critical patch on August 17, 2026 for CVE-2026-19478 (CVSS 9.4), which lets unauthenticated attackers remotely modify or delete public projects and user data via a GraphQL directive on self-managed CE/EE installations. Affected versions span 18.2 through 19.2; fixes are in 19.2.4, 19.1.6, 19.0.8, and 18.11.11, but versions 18.2–18.10 receive no patch. A second high-severity CSRF flaw (CVE-2026-19650, CVSS 7.1) in the GraphQL multiplex handler is also fixed in the same release.

Why: If your team runs self-managed GitLab in the affected range, patch to 18.11.11, 19.0.8, 19.1.6, or 19.2.4 immediately — unauthenticated remote deletion of public projects requires no victim interaction. Teams on versions 18.2–18.10 have no fix available and must upgrade to at least 18.11.11. GitLab.com and GitLab Dedicated users are already patched and need no action.