Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-19478
By Omer Idel |
17 August 2026
GitLab CE/EE GraphQL directive code injection enables unauthenticated modification or deletion
GitLab CE/EE contains a CWE-94 code injection flaw where a crafted GraphQL directive can let an unauthenticated attacker remotely modify or delete public projects and user data. Affects 18.2 < 18.11.11, 19.0 < 19.0.8, 19.1 < 19.1.6, 19.2 < 19.2.4. Remediate by upgrading to 18.11.11, 19.0.8, 19.1.6, or 19.2.4.