A critical code injection flaw in GitLab’s GraphQL API is being exploited in the wild, and the timeline should worry anyone who still measures patch urgency in weeks. CVE-2026-19478, rated CVSS 9.4, lets unauthenticated attackers modify, delete, and rewrite publicly accessible projects without any credentials, per The Hacker News. Researchers reproduced the flaw within minutes of disclosure; live exploitation followed within days.
What the bug allows
The vulnerability affects GitLab CE and EE from 18.2 up to the fixed releases — patches shipped in 19.2.4, 19.1.6, 19.0.8 and 18.11.11. Because the injection point sits in an unauthenticated GraphQL path, an attacker needs nothing but network reach to a vulnerable instance with public projects.
The impact goes beyond defacement. Per the report, attackers can delete repositories, forge merge records, and ban maintainers. For a platform that functions as the system of record for source code, forged merge history is the quietly dangerous one: a supply-chain-minded attacker does not want to delete your repository, they want to change what it says was reviewed and merged.
The compression problem
Exposure-management firm watchTowr, whose researchers reproduced the flaw, frames the speed as the real story. “This is the new reality of vulnerability reproduction and exploitation, where AI-enabled attackers are able to compress the time from disclosure to exploitation,” said Jake Knott, principal security researcher at watchTowr.
That compression has been building all year across the industry’s headline bugs, and this one makes the pattern hard to dismiss: a non-trivial injection chain was weaponized faster than many organizations complete a single patch-approval cycle. The comfortable assumption that complexity buys defenders time is expiring — reproduction work that used to take a skilled researcher days is increasingly automated.
What this means
If you run self-managed GitLab, this is a patch-now event: upgrade to 19.2.4, 19.1.6, 19.0.8 or 18.11.11, and audit public projects for unexpected merges, membership changes, or deleted history in the window since disclosure. Instances with no public projects reduce the unauthenticated surface but should still update.
The broader lesson lands on process, not product. Patch SLAs written for a world of multi-week exploit development — 30 days for critical, 90 for high — no longer match observed attacker behavior. For internet-facing developer infrastructure, the working assumption should be that disclosure and exploitation are the same week’s problem. That argues for automated patch pipelines on source-control systems, integrity monitoring on merge and audit events, and treating your code-hosting tier with the same urgency as your identity tier: both are control planes, and attackers have noticed.
