GitLab patches critical unauthenticated GraphQL flaw

On Monday, GitLab released patches for two vulnerabilities that affect Community and Enterprise Edition releases from 18.2, 19.0, 19.1 and 19.2 onward. The flaws are tracked as CVE-2026-19478 (CVSS 9.4) and CVE-2026-19650 (CVSS 7.1).

CVE-2026-19478 is an unauthenticated GraphQL code-injection vulnerability. An attacker could abuse a GraphQL directive to insert payloads that modify or delete user data and alter public projects.

CVE-2026-19650 is a cross-site request forgery issue in the GraphQL multiplex query handler. Improper request validation could allow an unauthenticated user to execute mutation operations via GET requests that should normally be blocked.

The advisory states: “GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.” The company published updated packages for affected self-managed instances.

Patches were applied automatically to GitLab.com and GitLab Dedicated; users of those hosted services do not need to act. Administrators of self-managed installations should upgrade immediately to one of the fixed releases: GitLab CE/EE 18.11.11, 19.0.8, 19.1.6 or 19.2.4.

GitLab credited reporters through its HackerOne bug bounty program and did not report any observed exploitation in the wild. The advisory lists the affected branches and the corresponding patched versions.

GraphQL directives can change how queries operate and the multiplex handler accepts multiple operations in a single request. Exploitation could involve injecting malicious directives to change repository contents or using the multiplex path to include mutation operations in GET requests that are not properly validated.

The advisory recommends applying the published updates right away to reduce exposure.