Dev · Security
Critical GitLab GraphQL flaw already under attack, watchTowr reports
Attack attempts against CVE-2026-19478, a critical GitLab vulnerability patched in an out-of-band release on Monday, have been observed by security firm watchTowr.
The flaw lets unauthenticated attackers delete projects and repositories with a single HTTP request. Admins are urged to patch immediately.
GitLab published unscheduled security updates for its code hosting platform on Monday, closing several vulnerabilities, some rated critical. Security researchers at watchTowr have now confirmed the first attack attempts against the most severe of these flaws.
The vulnerability CVE-2026-19478 carries a CVSS score of 9.4 and is rated critical. According to watchTowr's lead security researcher Jake Knott, it allows attackers without any prior authentication to delete publicly accessible GitLab projects, change their status, wipe entire repositories, forge merge entries, or lock out maintainers. A single HTTP request is enough. No credentials, no user interaction, and no unusual configuration are required.
Knott said on Wednesday that watchTowr had already detected in-the-wild attack attempts through its global honeypot network. Organizations running unpatched GitLab instances should search their web logs for the string "@gl_introduced" and look for signs of reconnaissance or exploitation.
On LinkedIn, watchTowr stated that its in-house AI tool reconstructed the vulnerability from the bug description and code changes alone. At the time of publication no public proof-of-concept exploit was available. On X, the company advised either updating self-managed installations immediately or, as a minimum, restricting access to "/api/graphql".
The same update wave also fixed a second GraphQL API vulnerability, CVE-2026-19650, rated high with a CVSS score of 7.1. Exploiting that one requires victim interaction, for example clicking a manipulated link.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.