IT security firm watchTowr says it has detected the first exploitation attempts in the wild against the severe GitLab vulnerability CVE-2026-19478. Lead security researcher Jake Knott said the flaw, which carries a CVSS score of 9.4, lets unauthenticated attackers delete publicly accessible projects, remove repositories, or lock out maintainers—all with a single HTTP request.
GitLab released out-of-band updates on Monday for its code hosting software, closing several security holes in the GraphQL module. Alongside the critical flaw, a high-severity issue (CVE-2026-19650, CVSS 7.1) was also fixed, though that one requires victim interaction.
watchTowr advises organizations that have not yet patched to scan logs for the string “@gl_introduced” and restrict access to “/api/graphql”. No public exploit code was available at the time of publication.
Source: www.heise.de
