GitLab Patches Multiple Security Flaws in CE and EE With 19.2.4 Update

GitLab has released critical security updates for both the Community Edition (CE) and the Enterprise Edition (EE), addressing two GraphQL-related vulnerabilities that could expose self-managed instances to unauthorized project manipulation and request-forgery attacks.

This patch release, issued on August 17, 2026, includes GitLab versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. Administrators operating affected self-managed deployments are urged to upgrade immediately.

GitLab Patches Multiple Security Flaws

The most serious issue, tracked as CVE-2026-19478, is a critical code-injection vulnerability affecting GitLab’s GraphQL directive processing. GitLab reports that, under certain conditions, an unauthenticated remote attacker could modify or delete public projects and user data.

This flaw has a CVSS score of 9.4, indicating that it is network-reachable, lacks an authentication requirement, and has a significant impact on integrity and availability.

While the vulnerability does not fully compromise confidentiality, the potential to alter or erase public project content makes it particularly severe for organizations using GitLab to host source code, documentation, CI/CD configurations, infrastructure-as-code files, and public development artifacts. Attackers could disrupt projects, tamper with build definitions, or destroy data available through public repositories.

GitLab also addressed CVE-2026-19650, a high-severity cross-site request forgery (CSRF) flaw in the GraphQL multiplex query handler.

This issue could allow an unauthenticated attacker to execute GraphQL mutations via GET requests when a victim interacts with a maliciously crafted request.

The vulnerability arises from improper request validation in GraphQL multiplex query handling and has been assigned a CVSS score of 7.1.

Although exploiting CVE-2026-19650 requires user interaction, successful attacks could compromise the integrity of GitLab resources accessible to victims.

Organizations should consider users with elevated project, group, or administrative privileges to be particularly valuable targets in CSRF-driven attacks. Both vulnerabilities affect GitLab CE and EE installations across multiple supported branches.

For customers using GitLab.com and GitLab Dedicated, these services are already operating on patched versions, so no action is required.

The advisory primarily pertains to self-managed environments, regardless of whether they use Omnibus packages, source installations, Helm charts, or other deployment models.

The release does not introduce any new database migrations. GitLab states that multi-node deployments should not require downtime when following their zero-downtime upgrade guidance.

However, Omnibus installations typically stop services, run migrations, and restart during an update by default. Administrators planning controlled or phased upgrades should review GitLab’s update documentation and deployment-specific procedures before applying the patches.

GitLab generally publishes vulnerability details 90 days after a fix is released, allowing administrators time to implement mitigations before technical information becomes public.

Security teams should prioritize inventorying their exposed self-managed GitLab servers, applying the relevant fixed versions, validating service availability after the upgrade, and monitoring audit logs for any unusual GraphQL activity or unauthorized changes to public projects.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world