GitLab GraphQL code injection vulnerability

By Editorial Team | August 27, 2026
A GitLab GraphQL code injection vulnerability (CVE-2026-19478, CVSS 9.4) was exploited within minutes of disclosure. What happened and how to patch now.

A GitLab GraphQL code injection vulnerability is now under active exploitation, reproduced and attacked within minutes of GitLab’s August 17, 2026 disclosure of CVE-2026-19478. The unauthenticated flaw (CVSS 9.4) lets an attacker delete public projects, forge fake fix records, or lock out maintainers on any unpatched self-managed GitLab instance. GitLab.com and GitLab Dedicated were already…

Read More