Infosec News Nuggets — August 19, 2026
Brief
GitLab Patches Critical Code Injection Vulnerability
GitLab issued an emergency out-of-cycle patch for a critical, unauthenticated code injection flaw tracked as CVE-2026-19478 (CVSS 9. 4), which stems from improper handling of a GraphQL directive and lets attackers modify or delete user data and public projects without logging in. A second, lower-severity CSRF bug in the GraphQL multiplex query handler was fixed in the same release.
The flaws affect all Community and Enterprise Edition versions from 18. 2 and 19. 0 through 19. 2, and were resolved in 18.
- 11, 19.
- 8, 19.
- 6, and 19.
- 4; GitLab. com and GitLab Dedicated were patched automatically, but self-managed instances need to upgrade immediately.
Both issues were reported through GitLab’s HackerOne bug bounty program, and there is no indication either has been exploited in the wild.