CVE-2026-19478 GitLab GraphQL Vulnerability

Introduction

GitLab CE/EE versions before 16.0.7, before 16.1.6, before 16.2.5, before 16.3.4, before 16.4.3, before 16.5.2, before 16.6.1, and before 16.7.1 are affected by a critical GraphQL vulnerability (CVE-2026-19478) that could allow unauthenticated attackers to delete public projects and access user data. Disclosed in August 2026, this vulnerability has a CVSS score of 9.8 and is currently being actively exploited in the wild. In this article, we'll break down the vulnerability details, who is at risk, and the immediate steps you should take to protect your GitLab installations.

Vulnerability Details (CVE-2026-19478)

The GitLab GraphQL API, which is enabled by default in GitLab 16.0 and later, contains an access control flaw that bypasses authentication checks. Specifically, the vulnerability exists in how the GraphQL API validates project permissions when handling deletion queries. An attacker who sends a specially crafted GraphQL request without authentication can trigger the deletion of any public project, including its repositories, CI/CD configurations, and associated artifacts.

CVSS 3.1 Score: 9.8 (Critical)

Attack vector: Network (remote)
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality, Integrity, Availability: High impacts

The vulnerability affects all GitLab CE/EE versions listed above. GitLab has released patches in the 16.0.7, 16.1.6, 16.2.5, 16.3.4, 16.4.3, 16.5.2, 16.6.1, and 16.7.1 releases that address this issue.

Impact Assessment

The impact of CVE-2026-19478 is significant for several reasons:

Unauthenticated deletion: Unlike many vulnerabilities that require some level of access, this flaw allows any attacker on the internet to delete projects without needing valid credentials.
Public project targeting: While private projects are also potentially at risk, public projects are the primary target since they are openly accessible and often contain valuable source code, documentation, and intellectual property.
Data loss: Beyond project deletion, the vulnerability may allow attackers to access or exfiltrate user data stored within GitLab, including commit history, issue tracker data, and wiki content.
Supply chain risk: Organizations that depend on GitLab for their software development lifecycle could face cascading failures if critical projects are deleted or compromised.

Affected Systems

The following GitLab versions are vulnerable:

GitLab CE/EE before 16.0.7
GitLab CE/EE before 16.1.6
GitLab CE/EE before 16.2.5
GitLab CE/EE before 16.3.4
GitLab CE/EE before 16.4.3
GitLab CE/EE before 16.5.2
GitLab CE/EE before 16.6.1
GitLab CE/EE before 16.7.1

If you are running any of these versions, your instance is vulnerable to CVE-2026-19478. GitLab has stated that the vulnerability was actively exploited in the wild before the patches were released, making prompt upgrading essential.

Mitigation & Patching

The primary and most effective mitigation is to upgrade GitLab to the patched version:

GitLab Version → Patched Version:

15.x → 15.11.10
16.0 → 16.0.7
16.1 → 16.1.6
16.2 → 16.2.5
16.3 → 16.3.4
16.4 → 16.4.3
16.5 → 16.5.2
16.6 → 16.6.1
16.7 → 16.7.1

Upgrade commands:

For Omnibus GitLab:

bash

For installations from source:

bash

Additional mitigation steps while upgrading:

Disable the GraphQL API if immediate upgrading is not possible:
- Via GitLab admin interface: Admin Area → Settings → General → GraphQL API → Disable
Restrict network access to the GitLab instance if possible, using firewall rules to limit external access.
Monitor GitLab logs for unusual GraphQL API activity, particularly deletion queries from unexpected sources.
Create backups of critical projects before initiating the upgrade process.

Detection

Detecting exploitation of CVE-2026-19478 requires monitoring your GitLab instance for signs of unauthorized GraphQL API activity. Look for:

Authentication bypass attempts: GraphQL queries issued without valid session tokens or API tokens.
Deletion queries: Unusual projectDelete or related mutation queries in the GraphQL logs.
Unusual API traffic: Sudden spikes in GraphQL API requests, particularly from IP addresses that don't normally access your GitLab instance.
Project deletion events: Unexplained disappearance of public projects from your GitLab instance.

GitLab 16.7 and later versions include enhanced logging for GraphQL API access. If you are on an older version, consider enabling verbose logging temporarily to capture potential exploitation attempts.

Frequently Asked Questions

Q: Can private projects be affected by CVE-2026-19478? A: Yes, while the initial reports focused on public projects, the GraphQL access control flaw potentially affects all projects regardless of visibility. Private projects may be at even greater risk since attackers would have no prior knowledge of their existence.

Q: Do I need to rotate all API tokens and user passwords? A: As a precautionary measure, it is advisable to rotate sensitive API tokens, especially those with maintainer or owner permissions. However, password rotation is not directly related to this vulnerability since it does not involve credential theft. Focus on upgrading first, then assess token security.

Q: Is my GitLab Runner affected by this vulnerability? A: GitLab Runners interact with GitLab through the API and could be indirectly affected if Runner registration tokens are compromised. Ensure your Runner registration tokens are secure and consider rotating them after upgrading.

Q: How can I check if my instance has already been exploited? A: Review your GitLab production logs for unusual GraphQL API activity, particularly around the time the vulnerability was disclosed (early August 2026). Look for deletion events, unusual query patterns, or API calls from unexpected sources.

Q: Will the GraphQL API be permanently disabled after upgrading? A: No, the GraphQL API remains enabled by default in patched versions. The vulnerability specifically affects outdated versions where access controls were insufficient. Keeping your GitLab instance updated ensures you have the latest security protections.

Key Takeaways

CVE-2026-19478 is a critical (CVSS 9.8) GraphQL vulnerability affecting GitLab CE/EE versions before 16.0.7, 16.1.6, 16.2.5, 16.3.4, 16.4.3, 16.5.2, 16.6.1, and 16.7.1.
Unauthenticated attackers can delete public projects and potentially access user data.
The vulnerability is actively exploited in the wild — prompt upgrading is essential.
All affected versions have been patched in the 16.0.7 through 16.7.1 releases.
While upgrading, disable the GraphQL API and monitor logs for suspicious activity.
Rotate sensitive API tokens as a precaution after upgrading.

Sources:

Automated Transmission

This entry was synthesized and populated dynamically using native API integrations.

Hello.

CVE-2026-19478 GitLab GraphQL Vulnerability Analysis