Emergency out-of-band security updates have been distributed for an enterprise DevOps and source code management platform to address a critical code injection defect. The vulnerability permits unauthenticated remote network actors to modify or delete public repository projects and manipulate underlying commit states.
The flaw, tracked as CVE-2026-19478 with a CVSS score of 9.4, impacts GitLab Community Edition and Enterprise Edition. The security issue stems from improper input validation inside GraphQL directive processing handlers. An unauthenticated attacker can format malformed GraphQL requests to bypass authorization controllers, deleting public project repositories and altering project metadata without valid credentials. Security researchers confirmed functional reproduction of the exploit within minutes of initial public disclosure.
Subverting central source code repositories introduces severe software supply chain risks. Armed with project modification access over public code repositories, threat actors can alter application source code, introduce malicious dependencies, and corrupt release artifacts before distribution to production environments.
– Upgrade GitLab installations to emergency patch releases 17.11.1, 17.10.5, or 17.9.8 immediately across self-hosted environments.
– Restrict public internet access to GraphQL endpoints on self-hosted GitLab instances, gating access behind zero trust proxies.
– Inspect application audit logs for anomalous GraphQL query executions targeting project deletion or state modification handlers.
– Verify repository commit histories and project integrity signatures across all public project trees.
DevOps platform protection demands rapid emergency security patching and strict API input validation to ensure central source code repositories remain protected from unauthenticated code injection payloads. #CodeDefence #GitLab #CodeInjection #SupplyChain #AppSec #PatchManagement #DevSecOps
/
