CVE-2026-19478

Published Aug 17, 2026·Updated Aug 17, 2026

NVD Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

Public Exploits & PoCs5 found

PoC: gitlab-cve-2026-19478-lab

Reproducible A/B lab + safe PoC for GitLab CVE-2026-19478 / CVE-2026-19650 (GraphQL @gl_introduced)

PoC: CVE-2026-19478

GitLab Code injection

PoC: CVE-2026-19478-PoC

CVE-2026-19478 PoC . Unauthenticated remote code-injection in GitLab's GraphQL layer

PoC: Gitlab-CVE-2026-19478

Gitlab-CVE-2026-19478

PoC: cve-2026-19478

CVE-2026-19478: GitLab GraphQL Vulnerability PoC

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free