GitLab Patches Critical Code Injection Vulnerability

GitLab has released urgent patches for two security flaws affecting recent versions of its platform, with the most severe being an unauthenticated code injection vulnerability identified as CVE-2026-19478. This critical defect, carrying a CVSS score of 9.4, permits attackers to modify or delete data through GraphQL directives without needing login credentials. Additionally, CVE-2026-19650 addresses a cross-site request forgery issue in the GraphQL multiplex query handler that could allow unauthorized mutations via GET requests.

All self-managed instances of GitLab Community Edition and Enterprise Edition from versions 18.2, 19.0, 19.1, and 19.2 onward are impacted and should be updated immediately to versions 18.11.11, 19.0.8, 19.1.6, or 19.2.4. While GitLab.com and Dedicated users have already received automatic updates, administrators of self-hosted environments must act quickly to mitigate these risks.