GitLab ships out-of-band fix for CVSS 9.4 GraphQL bug

GitLab shipped an out-of-band patch on August 17 for a critical GraphQL flaw that lets an unauthenticated attacker modify or delete public projects and user data on self-managed installations, The Hacker News reported. The bug, tracked as CVE-2026-19478 and scored 9.4, sits in a GraphQL directive whose specifics GitLab has not disclosed; technical details are held for roughly 90 days after the patch under the vendor's standard embargo.

The company's line to admins is blunt: "These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately." Fixed builds are 19.2.4, 19.1.6, 19.0.8, and 18.11.11, covering affected releases from 18.2 forward. GitLab.com and GitLab Dedicated tenants are already patched and require no action.

A second issue shipped in the same bundle. CVE-2026-19650, rated 7.1, is a cross-site request forgery weakness in the GraphQL multiplex query handler that lets attackers "execute mutations via GET requests" when a target is tricked into clicking. Both flaws were reported through GitLab's HackerOne bug bounty program, and no public exploit had surfaced as of the vendor advisory, per Help Net Security. It lands into a busy month for DevOps-infrastructure security coverage on our tracker, a day after a global GitHub outage rattled the same buyer set.