CVE-2026-19478 is a critical code injection flaw (CVSS 9.4) in GitLab CE and EE. Under certain conditions an unauthenticated user could remotely modify or delete public projects and user data through a GraphQL directive. GitLab fixed it in 19.2.4, 19.1.6, 19.0.8 and 18.11.11, released on 17 August 2026.
What's affected
Per the record and GitLab's patch release post:
- 18.2 up to before 18.11.11: fixed in 18.11.11
- 19.0 before 19.0.8: fixed in 19.0.8
- 19.1 before 19.1.6: fixed in 19.1.6
- 19.2 before 19.2.4: fixed in 19.2.4
GitLab says GitLab.com and GitLab Dedicated already run the patched version, so only self managed installations need action. It also strongly recommends upgrading to one of the patched versions immediately.
How to check if you're exposed
On the instance, read the version from the Help page, from the Admin Area, or with:
sudo gitlab-rake gitlab:env:info
Compare with the fixed versions above. Versions older than 18.2 are not in the affected range in the record, but GitLab recommends staying on a supported release.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Confirm your GitLab version and whether the instance is self managed.
- Back up the instance.
- Upgrade to 19.2.4, 19.1.6, 19.0.8 or 18.11.11, or to a later patch for your line.
- Review audit events for unexpected changes to public projects since 18.2 was installed.
Why it matters
The weakness is CWE-94, improper control of code generation, here tied to a GraphQL directive. GraphQL directives let a query change how a field is processed, and a flaw in handling them can let a request do more than the API intends.
The record gives no authentication and no user interaction, with high impact on integrity and availability. That combination explains the critical rating. GitLab's post lists a critical patch release, which the vendor reserves for high severity issues. The CVE is not in CISA's KEV list.
After you patch
Patching stops new abuse but does not tell you whether something already happened. Because the flaw allowed changes to public projects, compare project settings, protected branches and recent commits against what you expect. If your instance is reachable from the internet, treat the window between 18.2 and your upgrade as the period to review.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do GitLab.com users need to act?
No. GitLab says GitLab.com and Dedicated are already patched.
Which edition is affected?
Both Community and Enterprise Edition, per the record.
Sources
Last reviewed: 19 October 2026.
