What happened (short and not boring)
GitLab shipped an out-of-schedule security update after discovering a nasty GraphQL bug that, in certain scenarios, could let an unauthenticated attacker remotely alter or even wipe out public projects and some user data. The big one is tracked as CVE-2026-19478 and GitLab rates it as Critical with a CVSS of 9.4.
There’s also a second flaw, CVE-2026-19650, rated High (CVSS 7.1). That one is a cross-site request forgery (CSRF) issue in the GraphQL multiplex query handler and needs some user interaction to work — less dramatic than the critical bug, but still serious.
Who needs to act and how
If you run GitLab on your own kit (self-managed), you should update ASAP. GitLab.com and GitLab Dedicated have already been patched by the vendor, so hosted customers don’t need to lift a finger.
Fixes are included in the following patch releases — apply the one that matches your deployment:
- 19.2.4
- 19.1.6
- 19.0.8
- 18.11.11
Versions affected (summary):
- All releases from the 18.2 series up to (but not including) 18.11.11
- 19.0 releases prior to 19.0.8
- 19.1 releases prior to 19.1.6
- 19.2 releases prior to 19.2.4
Notes from the vendor: the patch shouldn’t require new database migrations and multi-node clusters are not expected to need downtime to apply it. GitLab says they’ll publish technical write-ups on their issue tracker roughly 90 days after the patch release (around mid-November 2026), so exploit details will be delayed for a bit.
At the time of the patch announcement, there were no confirmed in-the-wild exploit reports or public exploit code available — but a remote, unauthenticated network attack path with a high CVSS is not something to shrug at. If you’re running a self-managed instance, treat this like hot coffee spilled on your keyboard: clean it up now.