Two GitLab GraphQL Vulnerabilities: Unauthenticated Data Tampering and CSRF

1. Basic Information

• Article Title: GitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11
• Publisher: GitLab
• Publish Date: 2026-08-17
• Severity: High
• Original Source: GitLab
• Related Sources: Dark Reading, SecurityWeek (Report on Exploitation Attempts)
• Related Malware / Threat Groups: None / Unidentified
• Primary Target: CVE-2026-19478 (Vulnerability allowing unauthenticated, zero-click modification or deletion of public projects and user data)
• Related Vulnerability: CVE-2026-19650 (CSRF vulnerability allowing mutation execution from GET requests via GraphQL multiplex processing)
• Product: GitLab CE / EE self-managed environments

Differences Between the Two Issues

2. Executive Summary

These two vulnerabilities were fixed in the same update. CVE-2026-19478 allows an attacker to send direct requests to GitLab and modify or delete public data, while CVE-2026-19650 requires user interaction and allows GraphQL mutations to be executed via GET requests. Based on public information alone, there are no exploit-specific indicators available to determine which CVE a request targets.

Update on Explotion Observations: SecurityWeek reported that watchTowr observed real-world exploitation attempts targeting CVE-2026-19478 after disclosure. This report observes attack requests and does not confirm successful data modification or deletion on GitLab, nor does it indicate exploitation of CVE-2026-19650. Because technical details of the observed requests and outcomes cannot be verified from GitLab's primary information or published watchTowr materials, this report treats them as secondary information.

3. Attack Flow

Chain A: CVE-2026-19478

1. An attacker reaches a vulnerable self-managed GitLab instance over the network
2. Without authentication, the attacker sends a crafted request to GitLab's GraphQL feature
3. If undisclosed specific conditions are met, vulnerable processing related to GraphQL directives occurs
4. Public projects or user data are modified or deleted

GitLab has not disclosed the exact directive names, payloads, or targeted processing. Therefore, /api/graphql, specific directives, or mutations cannot be treated solely as definitive exploit indicators.

Chain B: CVE-2026-19650

1. An attacker targets a vulnerable self-managed GitLab instance
2. Triggered by user interaction, a GET request is sent to GraphQL multiplex processing
3. Due to improper request validation, a mutation is executed from the GET request
4. Processing corresponding to the mutation occurs on GitLab

Inference: Because this is a CSRF issue and CVSS lists User Interaction as Required, a scenario where a user is tricked into opening a crafted link is likely. However, GitLab has not disclosed the delivery method, required sessions, targeted mutations, or specific modification results.

4. Attacker Position and Execution Location

CVE-2026-19478

• The attacker is on an external or internal network that can reach the GraphQL feature of the vulnerable GitLab instance
• Attack requests are sent directly from the attacker to GitLab
• Vulnerable processing occurs inside the GitLab application
• Attacker authentication and user interaction are not required

CVE-2026-19650

• The attacker triggers user interaction to deliver a GET request to GraphQL multiplex processing
• Vulnerable processing occurs inside the GitLab application
• Inference: The conditions for CSRF to cause real harm may depend on the user's browser GitLab session and target operation privileges, but details remain undisclosed

GitLab.com and GitLab Dedicated are already patched. Administrators of self-managed environments are responsible for updating.

5. Visibility for Victims and Administrators

Users

• CVE-2026-19478: Possibility that public projects or user data are modified or deleted without user action
• CVE-2026-19650: Possibility that unintended GitLab actions occur after web interactions. However, specific mutations and results are not publicly disclosed
• Depending on notification settings and target operations, changes may appear in GitLab notifications, activity feeds, or on-screen states

Administrators / SOCs

• A vulnerable self-managed GitLab instance is running
• Unexplained modifications or deletions of public projects/user data
• No legitimate operator can be found around the time of the change
• Preceded or followed by unauthenticated GraphQL requests, or GET/multiplex requests
• However, these requests alone do not confirm exploitation of CVE-2026-19478 or CVE-2026-19650

6. Success and Failure Conditions

Success Conditions for CVE-2026-19478

• Self-managed GitLab is running a vulnerable version
• The attacker can reach GitLab's GraphQL feature
• The request meets undisclosed "specific conditions" defined by GitLab
• Public projects or user data targeted for modification or deletion exist

Success Conditions for CVE-2026-19650

• Self-managed GitLab is running a vulnerable version
• User interaction occurs
• A GET request reaches GraphQL multiplex processing
• Undisclosed conditions are met, and a mutation is executed
• Inference: The executed mutation may require user sessions or privileges to perform valid operations

Failure / Impact Mitigation Conditions

• Updated to 18.11.11, 19.0.8, 19.1.6, 19.2.4, or later
• Using GitLab.com or GitLab Dedicated
• Attack requests fail to meet undisclosed success conditions
• CVE-2026-19650: No user interaction occurs, or mutations from GET requests are rejected
• Inference (Temporary Workaround): Restrict external reachability until updates are applied. Because this impacts functionality, verification is required before application

7. What Happens Upon Success

• CVE-2026-19478: Modification or deletion of public projects or user data
• CVE-2026-19650: Execution of GraphQL mutations via GET requests. Specific mutations and final impacts are not publicly disclosed
• CVE-2026-19478 Inference: If modification targets include repository contents or CI/CD settings, the impact may spread to downstream clones, builds, and package consumers. However, this cannot be confirmed from the publicly disclosed modification scope alone
• Public materials do not show OS command execution, administrator privilege escalation, private repository reading, or credential theft

8. Observable Logs

GitLab has not published exploit-specific request formats or IOCs. The following points are observation points used for impact confirmation and timeline reconstruction, not direct proof of exploitation.

Email

• Project- or user-related notifications from GitLab
• CVE-2026-19650 Inference: Emails or messages that induced user interaction

Proxy / SWG / DNS

• HTTP requests to GitLab's GraphQL feature
• HTTP method, source IP, User-Agent, status, response size, request ID
• CVE-2026-19650: GET requests related to GraphQL multiplex processing
• If request bodies or queries are not stored, identifying vulnerability exploitation using HTTP logs alone is difficult

Endpoint / EDR

• Public information does not indicate code execution on the OS
• Prioritize GitLab application, Rails, reverse proxy, and audit logs over EDR

Identity / IdP

• GitLab users, sessions, sources, and timestamps corresponding to changes
• CVE-2026-19478: Changes lacking a legitimate operator
• CVE-2026-19650: Correlation between user interaction times, GET requests, and audit events

SaaS / Cloud

• GitLab audit events, project events, repository history, and configuration change history
• History of potentially affected related features such as package registries, CI/CD settings, webhooks, runners, and deploy keys
• However, public materials do not confirm which operations always generate specific audit events

Network

• Communication to GitLab via reverse proxies or load balancers
• Correlation between GraphQL request timestamps, HTTP methods, sources, request IDs, and GitLab-side logs

9. Determining Attack Success

Based on public information, data reading, session theft, and malware execution have not been confirmed for either vulnerability.

The observation of CVE-2026-19478 reported by SecurityWeek corresponds to "Attack attempt observed (Success unconfirmed)" in the table above. It is not treated as evidence of successful attacks or victim organizations.

10. Investigation Playbook

• Trigger: Detection of vulnerable versions, unexplained modifications or deletions of public projects/user data, suspicious GraphQL requests, or time-correlated GET/multiplex requests and user interactions. SecurityWeek exploitation reports increase investigation priority but are not IOCs proving compromise of an individual environment
• Initial Verification: Check GitLab version, deployment type, update timestamp, external exposure scope, HTTP methods, sources, request IDs, authentication subjects, target projects, and user interactions
• CVE Triage: Prioritize CVE-2026-19478 if unauthenticated, zero-interaction modifications/deletions of public data are confirmed. Prioritize CVE-2026-19650 if user interaction and mutation execution via GET requests are confirmed. Requests alone are inconclusive
• Log Preservation: Preserve GitLab application, Rails, reverse proxy, load balancer, audit logs, and project events
• Change Verification: Check diffs for public projects, user data, repositories, branch protections, webhooks, CI/CD variables, runners, packages, and deploy keys
• Containment: Update to the patched version. If compromise is suspected, restrict external reachability, preserve evidence, and restore from trusted Git history, configurations, and backups afterward
• Assessment Status: Affected Version / Suspicious Request / Vulnerable Processing Confirmed / Unauthorized Change Confirmed / Follow-on Impact Confirmed

11. Defense and Detection Ideas

• Top Priority: Update to 18.11.11, 19.0.8, 19.1.6, 19.2.4, or later
• Single Events: Because there are no exploit-specific public indicators, do not determine a CVE based solely on a single GraphQL request
• Time Correlation (CVE-2026-19478): Unauthenticated GraphQL requests → Public project/user data modification/deletion without a legitimate operator
• Time Correlation (CVE-2026-19650): User web interactions → GET/multiplex requests → Mutation execution or corresponding state changes
• Threat Hunting Perspective: Changes not tied to valid change tickets or operators, unusual sources or User-Agents, and multiple target modifications in a short time
• Log Gaps: Missing HTTP methods, request IDs, authentication subjects, GraphQL operations, or audit events makes correlating requests and outcomes difficult
• Temporary Measures (Inference): Restrict external reachability of GitLab, including GraphQL, until updated. WAFs and access controls cannot completely identify undisclosed payloads and do not replace official patches

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-19478 allows unauthenticated users to remotely modify or delete public projects and user data via GraphQL directives under specific conditions
• The CVSS score for CVE-2026-19478 is 9.4, with both Privileges Required and User Interaction set to None
• CVE-2026-19650 allows unauthenticated users to execute mutations from GET requests under specific conditions due to improper request validation in GraphQL multiplex query processing
• The CVSS score for CVE-2026-19650 is 7.1, with User Interaction set to Required
• Vulnerable versions are 18.0 through 18.11.11 (exclusive), 19.0 through 19.0.8 (exclusive), 19.1 through 19.1.6 (exclusive), and 19.2 through 19.2.4 (exclusive)
• GitLab.com and GitLab Dedicated are already patched
• SecurityWeek reported that watchTowr observed real-world attack attempts targeting CVE-2026-19478
• This report does not indicate successful data modification/deletion or exploitation of CVE-2026-19650
• GitLab primary information does not disclose directive names, payloads, targeted mutations, exploit-specific IOCs, or whether actual exploitation has occurred. Published watchTowr materials do not confirm technical details of the observed requests

Inference

• Because the request format for CVE-2026-19478 is undisclosed, correlating unauthenticated requests with unexplained modification results is more practical than relying on request signatures alone
• Because CVE-2026-19650 involves CSRF and requires user interaction, browser sessions and user permissions likely factor into the success conditions
• Restricting external reachability as a temporary measure before updating reduces risk, but it does not replace official patches

Hypothesis

• If public project contents or CI/CD settings can be modified, impact may spread to downstream builds and packages
• Detailed disclosures or patch diff analysis may lead to an increase in exploit attempts

13. MITRE ATT&CK Mapping

CVE-2026-19478

• T1190 – Exploit Public-Facing Application (High)
• T1565.001 – Data Manipulation: Stored Data Manipulation (High, if data modification succeeds)
• T1485 – Data Destruction (High, if deletion succeeds)

CVE-2026-19650

• T1204.001 – User Execution: Malicious Link (Low, as delivery via crafted links is an inference and GitLab primary sources do not specify delivery methods)
• T1565.001 – Data Manipulation: Stored Data Manipulation (Low, as executable mutations and impact on stored data remain undisclosed)

Because these techniques do not map perfectly to Enterprise ATT&CK techniques for CSRF or GraphQL mutation execution, mapping for CVE-2026-19650 is limited.

14. Unknowns / Additional Research

• CVE-2026-19478: Directive names, exact payloads, targeted processing, "specific conditions," and details of data that can be modified/deleted
• CVE-2026-19650: GET request formats, specific user interactions, required sessions/privileges, targeted mutations, and final impacts
• Exploit-specific HTTP/GraphQL IOCs for both vulnerabilities
• CVE-2026-19478: Request contents, sources, volumes, observation periods, success rates, and targets of attack attempts reported by SecurityWeek
• CVE-2026-19650: Presence or absence of active exploitation
• Audit event names consistently logged by GitLab for each operation
• Whether /api/graphql is the actual exploit request destination and whether CVEs can be identified from requests

15. Impact on SOCs and General Organizations

Organizations utilizing self-managed GitLab environments for development and CI/CD operations must first verify their exact versions and apply patches. CVE-2026-19478, in particular, requires no attacker authentication or user interaction, directly impacting the integrity and availability of public projects and user data. While SecurityWeek's exploitation reports elevate patch and investigation priority, organizations should not conclude that their environments are compromised or that attacks succeeded based on news reports alone.

Conversely, observing anonymous GraphQL or GET requests while details remain undisclosed does not allow defenders to determine which CVE is involved or whether exploitation succeeded. SOC teams must separately verify request presence, user interactions, authentication subjects, and GitLab modification results to build confidence levels step-by-step. Avoid over-interpreting incidents to assume OS RCE, private source code theft, or credential theft have occurred.

16. Summary by Target Audience

For SOC Teams

Correlate unauthenticated requests and unexplained public data modifications/deletions for CVE-2026-19478, and user interactions, GET/multiplex requests, and mutation execution results for CVE-2026-19650. Use SecurityWeek's exploitation reports to prioritize response, but do not determine CVEs or success based on requests alone.

For Administrators

Update vulnerable versions to patched releases. If compromise is suspected, preserve logs and review diffs for public projects, user data, repositories, and CI/CD-related settings. Do not treat temporary access restrictions as a substitute for patching.

For Users

If you notice modification or deletion notifications you did not trigger, or unintended GitLab changes after opening web links, report them to administrators or SOC teams before attempting to revert changes yourself.