In brief: GitLab has released a security update to fix a critical GraphQL vulnerability (CVE-2026-19478, CVSS 9.4) that allowed unauthorized attackers to delete public projects.
GitLab has published security updates for Community Edition (CE) and Enterprise Edition (EE) that fix a critical vulnerability in the GraphQL interface. Under certain conditions, unauthenticated attackers could remotely modify or delete public projects and user data.
The vulnerability is tracked as CVE-2026-19478 and is classified by GitLab as critical, with a CVSS score of 9.4. Both the Community Edition and the Enterprise Edition of the GitLab software are affected. The vulnerability lies in the platform’s GraphQL API and allows attackers, without prior authentication, to manipulate or delete public projects and associated user data under certain conditions.
For CISOs and security leaders at organizations using GitLab as a code repository and CI/CD platform, this vulnerability poses an immediate risk: since no authentication is required, the barrier to entry for attackers is significantly lowered. Publicly accessible projects are an integral part of many open-source and collaboration workflows, meaning a successful attack could result in data loss, reputational damage, and disruptions to development processes.
Those responsible should apply the security updates provided by GitLab immediately, if this has not already been done. It is also recommended to review the GitLab instance configuration for exposed GraphQL endpoints and to examine access and change logs for suspicious activity in the period before the patch was released.
Source: thehackernews.com · Published August 17, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.