Critical GraphQL Vulnerability (CVE‑2026‑19478) Enables Unauthenticated Modification/Deletion of Public GitLab Projects

Critical GraphQL Vulnerability (CVE‑2026‑19478) Enables Unauthenticated Modification/Deletion of Public GitLab Projects

What It Is — A critical flaw in GitLab’s GraphQL API (CVE‑2026‑19478) allows an attacker with no credentials to issue a specially‑crafted directive that can modify or delete public projects and associated user data.

Exploitability — Actively exploited in the wild; a public proof‑of‑concept exists. CVSS 9.4 (Critical).

Affected Products — Self‑managed GitLab installations on versions 18.2‑18.10 (unpatched) and earlier; patched releases are 19.2.4, 19.1.6, 19.0.8, and 18.11.11.

Why It Matters for Compliance & Audit Readiness

• SOC 2 Access Controls – The flaw bypasses authentication, directly violating the CC6.1 (Logical Access) and CC6.2 (User Access Management) criteria.
• Evidence of Due Diligence – Continuous monitoring of patch status and API exposure demonstrates a mature control environment that auditors expect.
• Defensible Audit Trail – Documenting remediation steps (patches, API restrictions, log reviews) provides concrete evidence for the Security principle during SOC 2 examinations.

Recommended Actions

1. Upgrade all self‑managed GitLab instances to the patched versions (19.2.4, 19.1.6, 19.0.8, or 18.11.11) immediately.
2. If upgrade is not possible, block unauthenticated access to /api/graphql at the perimeter firewall or WAF.
3. Disable public repositories where business needs allow.
4. Enable detailed logging for GraphQL requests and audit for the @gl_introduced directive.
5. Incorporate the patch‑status check into your continuous compliance monitoring pipeline.

Source: Security Affairs – GitLab Warns of Active Exploitation of Critical GraphQL Flaw