GitLab administrators are being urged to patch immediately after security researchers observed attempts to exploit CVE-2026-19478, a critical unauthenticated code injection vulnerability affecting self-managed GitLab Community Edition and Enterprise Edition instances.

The flaw, rated 9.4 out of 10, can allow remote attackers to modify or delete public projects and associated user data through GitLab’s GraphQL interface. GitLab issued an out-of-band update on August 17, 2026, outside its regular security release schedule.

The issue stems from improper handling of a GraphQL directive, which can be abused under specific conditions without requiring an account, authentication, or user interaction. This makes internet-facing GitLab deployments especially exposed.

Security firm WatchTowr reported that it reproduced the vulnerability within minutes of disclosure by analyzing GitLab’s public advisory and the vendor’s patch changes. Researchers said the practical impact may extend beyond GitLab’s short description of unauthorized modification or deletion.

An attacker could reportedly remove repositories, manipulate merge-related records to create a misleading appearance that changes were merged, or ban legitimate maintainers from public projects.

GitLab Code Injection Vulnerability

Exploitation activity has already been detected in the wild. watchTowr said its Attacker Eye honeypot network recorded attempts to exploit the vulnerability shortly after the disclosure, indicating that attackers are rapidly testing exposed GitLab instances.

While public technical details and proof-of-concept activity can accelerate weaponization, the main risk is the flaw’s pre-authentication access and low barrier to remote exploitation.

The vulnerability affects GitLab CE and EE versions 18.2 through 18.11.10, 19.0 through 19.0.7, 19.1 through 19.1.5, and 19.2 through 19.2.3. GitLab has released patched builds 18.11.11, 19.0.8, 19.1.6, and 19.2.4.

GitLab patched GitLab.com and GitLab Dedicated, and no customer action is required. However, organizations running self-managed GitLab installations must upgrade without delay.

Where an immediate upgrade is operationally difficult, defenders should identify internet-exposed instances, review whether public projects are enabled, and restrict access to the GraphQL endpoint via network controls or a reverse proxy until patching is complete.

Security teams should also review recent GraphQL activity, repository deletions, unexpected project modifications, suspicious changes to merge records, and unexplained maintainer access restrictions.

Given confirmed attempts at exploitation, organizations should treat exposed, unpatched GitLab servers as potentially compromised and preserve relevant logs before remediation.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Critical GitLab Code Injection Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.

GitLab has released security updates for Community Edition and Enterprise Edition, addressing 13 vulnerabilities affecting analytics dashboards, CI/CD workflows, APIs, AI services, project settings, and package management.

The company issued GitLab 19.2.2, 19.1.4, and 19.0.6 on August 12, 2026, and strongly advised self-managed customers to upgrade as soon as possible. GitLab.com is already patched, while GitLab Dedicated customers do not need to take action.

The update addresses six high-severity flaws, six medium-severity flaws, and one low-severity issue. The most serious problems include three cross-site scripting vulnerabilities and multiple authorization weaknesses that could let authenticated users perform actions beyond their intended permissions.

These bugs are especially important for organizations that use GitLab as a central platform for source code, CI/CD pipelines, package registries, and DevSecOps operations.

GitLab Patches Security Vulnerabilities

Two high-severity XSS flaws, tracked as CVE-2026-15217 and CVE-2026-15216, affect the Analytics Dashboards feature. Both bugs received a CVSS score of 8.7.

They occur because GitLab did not properly neutralize user-controlled values displayed in dashboard table cells and pagination controls.

An attacker capable of submitting crafted content could execute malicious JavaScript when another user views the affected dashboard content. Successful XSS attacks can expose session data, alter browser actions, or perform operations in the context of a targeted user.

Another high-severity issue, CVE-2026-15423, affects the CI/CD pipeline API and has a CVSS score of 8.5. GitLab said a developer-level user could, under certain conditions, run a pipeline on a protected branch without having the required push permission.

The weakness exists in pipeline reference validation. Protected branches commonly enforce stricter controls because they are used for production code, releases, or security-sensitive workflows. Unauthorized pipeline execution may pose risks to build artifacts, deployment logic, CI variables, or software supply chain processes.

GitLab also patched CVE-2026-16627, an XSS flaw in the CI manual job confirmation modal. The bug affects GitLab 19.2 versions before 19.2.2. It could allow a developer-level user to escalate privileges by exploiting improperly sanitized HTML rendered in the job modal.

The issue carries a CVSS score of 7.7. It demonstrates how UI-level injection flaws can have broader impact when they target privileged users reviewing CI/CD jobs.

Enterprise Edition users should also note authorization flaws in the Duo Workflow Service and ProjectsController. CVE-2026-19228 could allow authenticated users to attribute AI usage to another namespace.

At the same time, CVE-2026-16494 could allow changes to project settings that are normally restricted to higher-privileged roles. GitLab also resolved medium-severity authorization problems involving merge requests, external status checks, GitLab Duo settings, and AI Tool Rules.

Other patched issues include an unauthenticated denial-of-service condition in the GraphQL API JSON parser and an authorization weakness in the npm dist-tags endpoint.

The latter could allow developers to modify some package registry metadata without maintainer-level permission. Although these issues are rated lower, they can still affect service availability, project privacy, and software package integrity.

Administrators running vulnerable releases should upgrade to GitLab 19.2.2, 19.1.4, or 19.0.6, depending on their supported version branch.

Single-node deployments should plan for downtime, as the update includes database migrations that must complete before GitLab starts. Multi-node environments may apply the update without downtime when using GitLab’s zero-downtime upgrade procedures.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post GitLab 19.2.2 Patches 13 Security Flaws, Including High-Severity XSS and CI/CD Authorization Flaws appeared first on Cyber Security News.