Overview
- GitLab issued emergency fixes for affected Community and Enterprise releases after a security report showed an unauthenticated GraphQL directive could inject code and change project state.
- Security researchers reproduced the bug within minutes of public disclosure and warned AI-enabled tools could speed exploit development and scanning of exposed servers.
- WatchTowr reported that its honeypot network recorded in-the-wild exploitation attempts against unpatched, internet-facing self-hosted instances.
- Organizations should install the patched releases or, if they cannot upgrade immediately, block unauthenticated access to /api/graphql or remove public repositories and hunt web logs for probes containing the string '@gl_introduced'.
- The flaw lets attackers delete repositories, ban maintainers or forge merge and audit records, a capability that raises acute supply-chain and trust risks for teams that rely on GitLab for code review and release pipelines.