This Critical GitLab Flaw Lets Attackers Wipe Public Repos

Robert Moore · 2026-08-17

If you're running GitLab, you'll want to pay attention to this one. A newly disclosed vulnerability could let someone with no credentials at all walk in and delete or modify public projects on your instance. That's not a drill. The flaw, tracked as CVE-2026-19478, carries a CVSS score of 9.4 out of 10. GitLab has rated it Critical, and honestly, that feels about right. We're talking about unauthenticated attackers here—no login, no special access, just the ability to send the right request and watch your public repositories disappear or get tampered with. ### What's Actually Going On? The issue sits in GitLab's GraphQL API. Under certain conditions, that API fails to properly enforce authorization checks. In plain English: the system doesn't always verify who's asking before it does what's asked. If an attacker figures out the right GraphQL query, they could modify or delete public projects and the user data attached to them. This affects both the Community Edition (CE) and the Enterprise Edition (EE). So whether you're on the free tier or paying for the full enterprise package, you're exposed if you haven't patched. ### Why You Should Care Think about what lives in your GitLab instance. Source code, CI/CD pipelines, documentation, issue trackers, maybe even deployment credentials if someone got sloppy. A public project getting wiped isn't just an inconvenience—it's a potential disaster. Your team loses work, your release pipeline breaks, and if the attacker modifies code instead of deleting it, you could end up shipping something you never wrote. And because the attack requires no authentication, there's no warning before it happens. No suspicious login, no failed password attempts. Just a quiet request that shouldn't have been allowed. ### What GitLab Says GitLab has released security updates that address this vulnerability. If you're running an affected version, you need to upgrade. Not next week. Not when you get around to it. Now. - Check your current GitLab version against the patched releases - Apply the update to all your instances, including self-hosted ones - After patching, audit your public projects for any unexpected changes If you can't patch immediately, consider making public projects private temporarily. It's not a perfect fix, but it reduces the attack surface while you get your updates in order. ### The Bigger Picture This isn't the first time GitLab has dealt with a critical GraphQL issue, and it probably won't be the last. The lesson here is broader than just this one CVE: your development tools are attack surfaces too. We tend to lock down our servers and our databases, but the tools our teams use every day—the version control systems, the CI runners, the issue trackers—those matter just as much. An attacker who compromises your GitLab instance doesn't need to break into your production environment. They just need to wait until your next deploy and slip their code in there. That's the scary part. ### What You Should Do Right Now First, figure out what version you're running. GitLab has published the fixed versions, so compare yours against those. If you're behind, upgrade immediately. Second, review your public projects. If you have anything public that doesn't absolutely need to be, consider making it internal or private. The fewer exposed surfaces, the better. Third, keep an eye on your logs. Even with the patch applied, look for unusual GraphQL activity. Unauthenticated requests hitting your API that don't look like normal traffic deserve a second look. This one's serious, folks. Don't sit on it. Patch your GitLab instances, check your projects, and move on. Your future self—and your source code—will thank you.