GitLab has released emergency security patches for a critical flaw that allows anyone on the internet — no account required — to remotely delete or alter public projects and user data. The bug, tracked as CVE-2026-19478 (CVSS 9.4), lives in GitLab’s GraphQL layer and can be triggered over a network connection with no credentials and no interaction from a victim. The advisory notes that GitLab has withheld technical details about the specific directive involved and has not yet confirmed in-the-wild exploitation, but the zero-authentication requirement makes it a priority to patch.
A second issue fixed in the same release, CVE-2026-19650 (CVSS 7.1), is a cross-site request forgery weakness in the GraphQL multiplex query handler that requires a victim to click a crafted link to trigger. GitLab says both its hosted service (GitLab.com) and GitLab Dedicated instances have already been updated and need no action from those customers. Full technical details will be withheld until around mid-November 2026, roughly 90 days after the patch release.
How to check if you’re affected
Affected versions include all GitLab Community Edition and Enterprise Edition self-managed installations running versions 18.2 through 18.11.10. GitLab did not backport fixes to the 18.2–18.10 branches; those branches are end-of-life. The patched versions are 18.11.11, 19.0.8, 19.1.6, and 19.2.4. To check your current version, visit your instance’s /help page or run gitlab-rake gitlab:env:info. If your version is older than the patched releases listed above, update immediately.