A critical code injection vulnerability in GitLab (CVE-2026-19478) is being actively exploited by threat actors, allowing unauthenticated users to delete or modify public data.

  • CVE-2026-19478 is a critical code injection flaw with a CVSS score of 9.4.
  • Attackers can modify or delete public projects without any authentication.
  • Exploitation began within just two days of the vulnerability's public disclosure.
  • Immediate patching of GitLab Community and Enterprise editions is required.

Threat actors have begun actively exploiting a critical-severity vulnerability in GitLab, according to a warning from attack surface management firm WatchTowr. The flaw, tracked as CVE-2026-19478, was exploited roughly two days after its public disclosure, highlighting the shrinking window between vulnerability discovery and active exploitation.

With a staggering CVSS score of 9.4, this code injection defect allows an unauthenticated attacker to remotely manipulate data. GitLab confirmed that under certain conditions, a user could use a GraphQL directive to modify or delete public projects and user data. Patches have already been rolled out for various versions, including GitLab CE and EE 19.2.4, 19.1.6, 19.0.8, and 18.11.11.

Read Also:Critical Vulnerability Discovered in Ruby on Rails: Potential for Remote Code Execution

Why This Matters

BozokMedia analysis shows that the rise of AI-enabled attackers is fundamentally changing the threat landscape. The time available for organizations to apply patches is disappearing. As WatchTowr noted, they were able to reproduce the vulnerability within minutes of disclosure using only the advisory details, suggesting that AI-driven automated attacks are likely following closely behind.

An attacker can delete repositories, forge merge records, or ban maintainers in a single HTTP request with no credentials required.

The implications for Supply Chain Security are profound. Patrick Münch, co-founder of Mondoo, warned that this flaw could fuel a new wave of supply chain attacks. By forging merge records, an attacker can make malicious code changes appear as though they were reviewed and approved by trusted team members, effectively bypassing traditional code review processes and compromising the entire downstream pipeline.

Historical Background

In the history of cybersecurity, supply chain attacks have consistently been among the most damaging. From the SolarWinds breach to more recent incidents, attackers have targeted the tools developers trust most. The GitLab flaw represents a modern evolution where the speed of exploitation is accelerated by advanced automation and AI tools.

Did You Know?: Modern cyberattacks are increasingly automated, with bots scanning the internet for specific unpatched vulnerabilities the moment a CVE is published.

Frequently Asked Questions

1. What should organizations do to mitigate this risk?
Organizations should immediately update to the patched versions of GitLab and consider restricting unauthenticated access to the /api/graphql endpoint.

2. Can this vulnerability affect private repositories?
The current disclosure focuses on the ability to modify or delete public projects, but the severity of the code injection warrants immediate attention for all users.