Overview
- GitLab released the emergency fix on August 17 to remediate CVE-2026-19478, a critical unauthenticated GraphQL directive flaw scored 9.4 that can modify or delete public projects and user data.
- The company bundled a second fix in the same release for CVE-2026-19650, a High‑severity CSRF weakness in the GraphQL multiplex query handler that requires user interaction.
- Only self-managed GitLab CE/EE installations must act; GitLab.com and GitLab Dedicated were already patched and need no action from users.
- Patched releases are 19.2.4, 19.1.6, 19.0.8 and 18.11.11, while versions on branches 18.2 through 18.10 remain unsupported and administrators on those releases must upgrade to a patched branch.
- GitLab reported no evidence of in‑the‑wild exploitation and will withhold full technical details until its disclosure window, which raises a short‑term risk that attackers could try to reverse‑engineer public patch diffs.