What is the CVSS score of CVE-2026-19478?

CVE-2026-19478 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of GitLab are affected by CVE-2026-19478?

GitLab Community and Enterprise editions (versions 18.2-19.2.3) contain a critical, unauthenticated vulnerability allowing remote attackers to modify or delete public projects and user data without…. A patch is available.

Is there a public PoC exploit available for CVE-2026-19478?

Yes, a public proof-of-concept exploit is available for CVE-2026-19478. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2026-19478?

Within 24 hours, inventory all GitLab deployments and identify which are running versions 18.2-19.2.3. Within 7 days, implement compensating controls: restrict public project visibility to internal-only, disable GraphQL API access if not required operationally, and apply network-level access restrictions to GitLab systems. Within 30 days, monitor GitLab security advisories for patch availability and deploy immediately upon release; maintain heightened logging and alerting on all project and user data modifications until patched.

GitLab CVE-2026-19478

EUVD-2026-60443 CRITICAL

Code Injection (CWE-94)

2026-08-17 GitLab

GHSA-6whr-xjjm-6pf8

Gitlab Code Injection RCE

9.4

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

9.4 CRITICAL

Remote, unauthenticated, no user interaction (AV:N/AC:L/PR:N/UI:N) via GraphQL; impact is data modification/deletion so I:H/A:H with only incidental read exposure (C:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Threat Model Generated

Aug 30, 2026 - 19:34 vuln.today

Patch available

Aug 17, 2026 - 21:17 EUVD

Analysis Generated

Aug 17, 2026 - 20:32 vuln.today

CVE Published

Aug 17, 2026 - 20:04 cve.org

CRITICAL 9.4

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

Articles & Coverage 2

medium.com CVE-2026-19478: GitLab GraphQL Read Operation Executes Write-Level Code via Slot Confusion Aug 20, 2026 News Critical Unauthenticated Data Tampering in GitLab CE/EE - CVE-2026-19478 Aug 17, 2026

AnalysisAI

Unauthenticated data tampering in GitLab CE/EE (18.2-18.11.10, 19.0-19.0.7, 19.1-19.1.5, 19.2-19.2.3) lets a remote attacker modify or delete public projects and user data by abusing a GraphQL directive, per CVE-2026-19478 (CVSS 9.4). The flaw was self-reported by GitLab and publicly available exploit code exists via a HackerOne disclosure, though it is not listed in CISA KEV. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the target GitLab instance's GraphQL API and abuse of a specific GraphQL directive; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority issue rather than an inflated CVSS number: the vector is fully remote and unauthenticated (AV:N/AC:L/PR:N/UI:N) against a widely deployed developer platform, exploit code is public via HackerOne report 3926431, and integrity/availability impact is HIGH. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to GitLab 18.11.11, 19.0.8, 19.1.6, or 19.2.4 (or later) depending on your release branch, as described at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/. … Detailed patch versions, workarounds, and compensating controls in full report.