GitLab CVE-2026-19478 Actively Exploited Within Days of Disclosure

A newly disclosed critical vulnerability in GitLab, tracked as CVE-2026-19478 (CVSS 9.4), is already being actively exploited in the wild, according to security firm watchTowr. The flaw is a code injection issue that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions, without requiring credentials or user interaction.

Affected versions include GitLab Community Edition (CE) and Enterprise Edition (EE) in the following ranges: 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. GitLab has released patched versions (19.2.4, 19.1.6, 19.0.8, and 18.11.11) and noted the issue can be exploited via a GraphQL directive.

watchTowr reproduced the vulnerability within minutes of disclosure and observed exploitation attempts against its honeypot network. The firm warns that AI-enabled attackers are compressing the time from disclosure to exploitation, making it critical for organizations to patch immediately. If patching is not possible, watchTowr recommends restricting unauthenticated access to the “/api/graphql” endpoint or removing public repository access entirely.

The impact goes beyond data modification: attackers can delete entire repositories, forge merge records to hide missing fixes, and ban project maintainers. Organizations running internet-facing self-hosted GitLab instances should prioritize upgrading and hunt through web logs for requests containing “@gl_introduced” to detect potential probes.