a single request, no login, no clicks — and your public GitLab repo is gone

GitLab's emergency patch fixes a code-injection bug that let an unauthenticated attacker delete repositories, forge merge records, or ban… Aliteq Priya Nair · Software & Systems Editor

CVE-2026-19478 is a CVSS 9.4 code-injection flaw in a GitLab GraphQL directive, exploitable with no authentication and no user interaction.

It let an attacker delete public projects, rewrite merge records, or ban maintainers in a single HTTP request.

Affected: GitLab CE/EE 18.2 up to 18.11.11, 19.0 up to 19.0.8, 19.1 up to 19.1.6, and 19.2 up to 19.2.4.

Fixed in 18.11.11, 19.0.8, 19.1.6, and 19.2.4, released August 17, 2026; GitLab.com and GitLab Dedicated were already patched.

watchTowr reproduced the exploit within minutes of disclosure; in-the-wild attacks began roughly two days later.

Patrick Münch at Mondoo put it better than I would: an attacker exploiting this doesn't just delete things loudly — they can make a malicious change look reviewed and signed off by someone your team…

The part I'd actually worry about

Read the full story

Aliteq a single request, no login, no clicks — and your public GitLab repo is gone Read the full story on Aliteq