GitLab Ships an Out-of-Band Critical Fix
Fixed in 19.2.4, 19.1.6, 19.0.8 and 18.11.11. If you are on 18.2 through 18.10, there is no patch for your branch — the upgrade is the fix.
Founder, Automation Squad ·
The short answer
CVE-2026-19478 is a code injection vulnerability in GitLab CE/EE reached through a GraphQL directive, rated CVSS 9.4. It is exploitable remotely by an unauthenticated attacker with no user interaction, and can be used to modify or delete public projects and user data. GitLab released an out-of-band patch on August 17, 2026 in versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11. GitLab.com and GitLab Dedicated already run patched versions.
Find your version in this table and do what the row says
GitLab shipped this outside the usual twice-monthly cadence, which is the company telling you something about urgency. Self-managed instances are the ones that have to act.
Read your version off the instance, not off memory
The admin area shows it, and so does /help. Guessing which minor you are on is how an instance stays unpatched for a fortnight while everyone assumes someone else checked.
If you are on 18.2 to 18.10, plan a branch upgrade rather than a point release
This is the sharp edge of this advisory. Those branches are inside the affected range and outside the fix, so there is no small hop available. Treat it as the upgrade you were going to do eventually, brought forward.
Check exposure while you schedule
The attack needs no authentication and no user interaction, so an instance reachable from the internet is the priority. An instance reachable only from a VPN is better off, but not a reason to defer.
Take a backup you have actually restored before
The impact here is deletion of projects and user data. A backup nobody has tested is a hypothesis. Before upgrading is a reasonable moment to stop hypothesising.
| Your version | What to do |
|---|---|
| 19.2.x below 19.2.4 | Upgrade to 19.2.4 |
| 19.1.x below 19.1.6 | Upgrade to 19.1.6 |
| 19.0.x below 19.0.8 | Upgrade to 19.0.8 |
| 18.11.x below 18.11.11 | Upgrade to 18.11.11 |
| 18.2 through 18.10 | Affected, and no fix ships for these branches. Upgrade the branch. |
| GitLab.com or GitLab Dedicated | Nothing. Already patched. |
GitLab released an emergency patch on August 17, 2026, outside its usual twice-monthly release schedule, for CVE-2026-19478 — a code injection vulnerability reachable through a GraphQL directive and rated CVSS 9.4.
The facts: the flaw is exploitable remotely by an unauthenticated attacker with no user interaction, and successful exploitation allows modification or deletion of public projects and user data. Fixed versions are 19.2.4, 19.1.6, 19.0.8 and 18.11.11. The affected range covers 18.2 up to 18.11.11, 19.0 up to 19.0.8, 19.1 up to 19.1.6 and 19.2 up to 19.2.4. The 18.2 through 18.10 branches sit inside the affected range and receive no fix of their own. GitLab.com and GitLab Dedicated already run patched versions, so this lands on self-managed installations.
Automation Squad's take: the number that matters is not 9.4, it is the gap between 18.2 and 18.10. Anyone sitting on those branches has been handed a critical, unauthenticated, no-interaction bug with no small upgrade available — and instances get parked on old branches precisely because upgrading felt like it could wait. It could. It cannot now. The other thing worth noticing is where this keeps happening: this is the third GraphQL flaw GitLab has patched this year, which suggests the interesting attack surface on a mature application is the flexible query layer somebody added later, not the routes that have been there since the beginning.
Run this now: read the version off the instance rather than from memory, and match it against the table above. If you are on 18.2 to 18.10, book the branch upgrade today rather than looking for a point release that does not exist. Prioritise anything reachable from the internet, since the attack needs neither credentials nor a click. And take a backup you have restored at least once before you start, because the impact of this bug is deletion.
Questions people are asking
- What can an attacker actually do?
- Modify or delete public projects and user data, without authenticating and without any interaction from a user. It is reached through a GraphQL directive and is classed as code injection, rated CVSS 9.4.
- Which versions are fixed?
- 19.2.4, 19.1.6, 19.0.8 and 18.11.11, released out-of-band on August 17, 2026.
- I am on 18.6. What is my patch?
- There isn't one for that branch. Versions from 18.2 up to 18.11.11 are in the affected range, and the fixes cover 18.11.11 and the 19.x branches. Moving off 18.2–18.10 is the remediation.
- Do I need to do anything on GitLab.com?
- No. GitLab.com and GitLab Dedicated are already running patched versions. This is a self-managed problem.
Sources
Further reading
- Help Net Security — Critical GitLab flaw allows attackers to modify or delete public projects — Clear summary of the affected and fixed version ranges.
Last checked August 18, 2026 against the primary sources above, by Automation Squad Research. Spot an error? [email protected].