Two GitLab GraphQL Vulnerabilities: Unauthenticated Data Tampering and CSRF

1. Basic Information

• Article Title: GitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11
• Publisher: GitLab
• Publication Date: 2026-08-17
• Severity: High
• Original Source: GitLab
• Related Sources: Dark Reading, SecurityWeek
• Related Malware / Threat Groups: None / Unidentified
• Primary Target: CVE-2026-19478 (Unauthenticated, zero-click GraphQL directive abuse)
• Related Vulnerability: CVE-2026-19650 (GraphQL multiplex CSRF requiring user interaction)
• Product: GitLab CE / EE self-managed

2. Executive Summary

GitLab fixed two vulnerabilities in the same patch release, but they have different attack entry points. CVE-2026-19478 is an unauthenticated, zero-click attack sent directly to GitLab by an attacker. CVE-2026-19650 is a CSRF attack that tricks a user into opening a crafted link.

CVE	Attack Entry Point	Authentication & User Interaction	Main Result	Investigation Indicators
CVE-2026-19478	Crafted request from an attacker to /api/graphql	No attacker auth required, no user interaction required	Modification or deletion of public project / user data	GraphQL requests without an authentication subject and subsequent data changes
CVE-2026-19650	GET request to the GraphQL multiplex handler via a crafted link	Requires the user to view the link	Data modification or deletion via mutation	GET request for a mutation, link viewing activity, and the corresponding browser context

3. Attack Flow

Chain A: CVE-2026-19478 (Direct Attack Sent to GitLab)

1. An attacker reaches a vulnerable self-managed GitLab instance.
2. The attacker sends a crafted GraphQL request to /api/graphql without authentication.
3. The request exploits vulnerable directive processing to reach unauthorized mutation-like functions.
4. It modifies or deletes public project or user data.
5. Inference: If repository settings or public content are altered, it may cause secondary impacts on the software supply chain or users.

Chain B: CVE-2026-19650 (Via the User's Browser)

1. An attacker tricks a victim into opening a crafted link.
2. A GET request is sent to the GraphQL multiplex query handler.
3. Insufficient request validation causes the mutation to execute.
4. Data modification or deletion occurs.

GitLab plans to keep details private for 90 days after the fix. Therefore, the exact directive name, payload, and the full scope of modifiable data remain unpublished.

4. Attacker Position and Execution Location

CVE-2026-19478

• The attacker is external and can reach the GitLab GraphQL endpoint.
• The attacker sends requests directly to /api/graphql.
• No attacker authentication or user interaction is required. The vulnerable processing runs in the GitLab application / GraphQL resolver layer.

CVE-2026-19650

• The attacker prepares a crafted link and lures a user to click it.
• The GET request is sent from the user's browser to the GraphQL multiplex handler.
• Inference: For data modification to succeed as a CSRF attack, a valid browser context with modification rights (such as an active GitLab session) is likely required.

GitLab.com and GitLab Dedicated are already patched, and users do not need to take action.

5. Visibility for Victims and Administrators

Users

• CVE-2026-19478: Public projects or user data are unexpectedly modified or deleted without any user action.
• CVE-2026-19650: Data modification or deletion may occur after viewing a crafted link.
• Common: Depending on notification settings, changes may appear in email notifications or activity logs.

Administrators / SOC

• CVE-2026-19478: /api/graphql requests without an auth session, directives/mutations from anonymous sources, and immediate project/user data changes.
• CVE-2026-19650: Multiplex mutations via GET requests, changes occurring shortly after a user views a link, and browser-initiated requests.
• Common: Changes originating from the Web/API layer rather than Git operations, and a mismatch between GraphQL/reverse proxy logs and audit logs.

6. Success and Failure Conditions

Success Conditions for CVE-2026-19478

• The self-managed GitLab instance is running a vulnerable version.
• The GraphQL endpoint is reachable by the attacker.
• An unpublished request meeting "specific conditions" is accepted.
• Public projects or target user data exist.

Success Conditions for CVE-2026-19650

• The self-managed GitLab instance is running a vulnerable version.
• A user opens a crafted link.
• A GET request reaches the GraphQL multiplex handler and is accepted as a mutation.
• Inference: The user's browser context has permission to modify the target data.

Common Failure Conditions

• Updated to version 18.11.11, 19.0.8, 19.1.6, 19.2.4, or later.
• Using GitLab.com or GitLab Dedicated.
• Placing the GraphQL endpoint behind a VPN or restricting external access until updated.
• Detecting suspicious GraphQL requests and subsequent changes, followed by blocking and recovery.
• For CVE-2026-19650, the user does not open the crafted link, or the request is rejected as a mutation.

7. What Happens on Success

• CVE-2026-19478: Modification or deletion of public projects or user data by an anonymous external attacker.
• CVE-2026-19650: Data modification or deletion via mutations through the user's browser.
• Common: Loss of service availability and data integrity.
• Inference (mainly for CVE-2026-19478): If public repository contents or settings are altered, it could impact downstream users who clone, use packages, or run CI/CD pipelines.
• Public data does not confirm OS command execution, admin privilege escalation, or private repository reading.

8. Observable Logs

Email

• Common: GitLab project/user change notification emails.
• CVE-2026-19650: Emails or messages distributing the crafted link.

Proxy / SWG / DNS

• CVE-2026-19478: Anonymous requests from external sources to /api/graphql, queries containing directives/mutations, and repeated requests from a single IP to multiple projects.
• CVE-2026-19650: Access to the crafted link followed by GET/multiplex queries to /api/graphql.

Endpoint / EDR

• No OS execution has been confirmed, making endpoint logs harder to capture.
• Focus should be on GitLab application/Rails logs, GraphQL logs, and audit logs.

Identity / IdP

• CVE-2026-19478: No corresponding authenticated session or user exists for the change operation.
• CVE-2026-19650: Verify if a user session corresponds to the request and whether the operation was intended by the user.

SaaS / Cloud

• GitLab audit events, project events, and API/GraphQL logs.
• Change history for object storage, package registries, and CI/CD settings.

Network

• Reverse proxy access logs showing /api/graphql requests.
• External source IPs, HTTP methods, statuses, response sizes, and request frequency.

9. Attack Success Assessment

Assessment Stage	CVE-2026-19478	CVE-2026-19650
Attack attempt observed (Success unconfirmed)	Anomalous anonymous GraphQL requests observed, but vulnerable processing or data changes unconfirmed	Crafted link views or GET/multiplex requests observed, but mutation success or data changes unconfirmed
User interaction	Not required	Link viewing confirmed
Initial execution	Confirmed requests reaching vulnerable directive processing	Confirmed GET requests reaching the multiplex handler and processing mutations
Authentication & Privileges	No attacker auth success, but anonymous processing succeeded	Not an auth bypass. Check if the user's browser context was used
Data breach	Success confirmed via modification/deletion of public project/user data	Success confirmed via data modification/deletion after link viewing
Subsequent compromise	Check for spread to repositories, CI/CD, packages, etc.	Check modified data and subsequent operations

Public information does not confirm data reading or session theft for either vulnerability.

10. Investigation Playbook

• Trigger: Detection of a vulnerable version, anonymous GraphQL requests indicating CVE-2026-19478, GET/multiplex mutations indicating CVE-2026-19650, or unexplained project/user changes.
• Initial Verification: Check GitLab version, deployment type, GraphQL public exposure, HTTP methods, authentication subjects, user interaction, update timestamps, and target projects to classify the CVE.
• System Logs: Preserve GitLab application, GraphQL, Rails, reverse proxy, and audit logs.
• Auth & Cloud: For CVE-2026-19478, confirm the lack of a corresponding actor. For CVE-2026-19650, correlate user sessions with link viewing.
• Subsequent Operations: Check diffs in repositories, branch protections, webhooks, CI/CD variables, runners, packages, and deploy keys.
• Containment: Update immediately. If difficult, stop external access, put behind a VPN, or restrict anonymous GraphQL. Restore changes from trusted backups or Git history.
• Classification: Exposure / Suspicious GraphQL / Unauthorized Mutation / Data Destruction / Supply-Chain Impact

11. Defense and Detection Ideas

• Single Event: Anonymous /api/graphql requests containing directives/mutations for CVE-2026-19478; GET-based multiplex mutations for CVE-2026-19650.
• Time-Series Correlation (CVE-2026-19478): Anonymous GraphQL → Project/user changes → Repository/CI settings diffs → Downstream pipeline execution.
• Time-Series Correlation (CVE-2026-19650): Crafted link view → GET/multiplex mutation → Unintended user data changes.
• Hunting Perspective: CVE-2026-19478: Missing actor, multi-project changes in a short time. CVE-2026-19650: GET mutations, browsing history, and inconsistency with user intent.
• Log Gaps: If GraphQL queries and variables are not logged, identifying exploits is difficult.
• Priority Actions: Update software, preserve GraphQL logs, restrict public exposure, and verify project/user data integrity.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-19478 can modify or delete public projects or user data via GraphQL directives without authentication or user interaction.
• The CVSS score for CVE-2026-19478 is 9.4.
• CVE-2026-19650 requires user interaction and can execute mutations due to improper validation of GraphQL multiplex GET requests.
• Patched versions are 18.11.11, 19.0.8, 19.1.6, and 19.2.4.
• GitLab.com and Dedicated are already patched.
• No active exploitation has been reported at the time of publication.

Inference

• Due to a lack of exploit details, detecting anomalous anonymous operations and mismatched results is more practical than IOC matching.
• Modification of public repositories or CI/CD settings can impact the software supply chain.

Hypothesis

• Exploits might be created via patch diff analysis even before full details are published.
• Automated scanning attacks targeting internet-exposed self-managed GitLab instances may appear.

13. MITRE ATT&CK Mapping

CVE-2026-19478

• T1190 – Exploit Public-Facing Application (High)
• T1565.001 – Data Manipulation: Stored Data Manipulation (High)
• T1485 – Data Destruction (High. If deletion occurs)
• T1195.002 – Compromise Software Supply Chain (Low. Only if downstream deliverables are modified)

CVE-2026-19650

• T1204.001 – User Execution: Malicious Link (Low. Mapped only for tricking users into opening crafted links)
• T1565.001 – Data Manipulation: Stored Data Manipulation (Medium. If mutation-based changes succeed)
• T1485 – Data Destruction (Medium. If deletion succeeds)

Since this is not a direct match for standard Enterprise ATT&CK CSRF techniques, the mapping for CVE-2026-19650 is limited.

14. Unknowns and Further Investigation

• CVE-2026-19478: Directive name, exact payload, target resolvers, "specific conditions," and reachability beyond public projects.
• CVE-2026-19650: Crafted link format, required user permissions, target mutations, and browser/cookie conditions.
• Exploit-specific HTTP/GraphQL IOCs.
• Presence of active exploitation.
• Event types guaranteed to appear in GitLab audit logs.

15. Impact on General SOCs and Enterprises

Many organizations use self-managed GitLab as a development and CI/CD platform. CVE-2026-19478 is the highest priority because it requires neither authentication nor user interaction. CVE-2026-19650 is a separate chain requiring user interaction, and investigators should check for correlations between GET mutations and link views. Both share the same patched versions, but investigations should not treat them as the exact same attack vector. Note that remote code execution (RCE) or private source code theft has not been confirmed at this time.

16. Summary by Role

For SOCs

Correlate anonymous GraphQL requests and change results for CVE-2026-19478, and GET mutations with user link views for CVE-2026-19650. Preserve GraphQL queries, variables, HTTP methods, and authentication subjects.

For Administrators

Immediately update to the patched versions. If an update is difficult, disconnect GraphQL from the external network, and verify the integrity of public projects, webhooks, CI/CD pipelines, runners, and deploy keys.

For Users

If you receive notifications about project deletions or settings changes after opening a suspicious link or without performing any actions yourself, report it to your administrator or SOC immediately before trying to revert it yourself.