Unauthenticated attackers have begun exploiting a critical code-injection vulnerability in GitLab shortly after its public disclosure this month [1, 4].
The flaw allows hackers to gain control over public projects without needing login credentials. Because GitLab is a globally hosted platform for code hosting, this vulnerability puts a vast amount of open-source software and proprietary user data at risk of deletion or unauthorized modification [1, 3].
The vulnerability, identified as CVE-2026-19478 [1], is a GraphQL-related flaw. It carries a CVSS severity score of 9.4 [3], a rating that reflects the ease with which an attacker can execute the exploit and the potential for severe impact on the target system.
GitLab released an emergency patch on Aug. 17, 2026 [3], to address the security gap. Despite the rapid response, reports indicate that exploitation began within days of the vulnerability becoming public [4].
The Hacker News staff said the vulnerability allows unauthenticated attacks to modify or delete public projects under certain conditions [4]. This represents the third GraphQL-related flaw reported in 2026 [3].
SecurityWeek editorial said hackers started exploiting the vulnerability shortly after public disclosure [1]. The attack vector does not require the attacker to have an account on the affected system, significantly increasing the pool of potential threats.
Administrators of GitLab instances are urged to apply the emergency update immediately to prevent unauthorized access to their repositories. The company has not yet released the total number of projects affected by the active exploitation [1, 3].
“The flaw allows hackers to gain control over public projects without needing login credentials.”
The rapid exploitation of CVE-2026-19478 highlights a shrinking window between the disclosure of a vulnerability and its weaponization by attackers. Because this is the third GraphQL flaw found in GitLab this year, it suggests a systemic weakness in how the platform handles these specific queries, potentially making it a primary target for unauthenticated attacks in the future.
