Infosec News Nuggets — August 18, 2026
Brief
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab shipped an out-of-cycle patch for a critical flaw, tracked as CVE-2026-19478 with a CVSS score of 9. 4, that could have let an unauthenticated attacker remotely modify or delete public projects and user data through a GraphQL directive. The fix landed in versions 19.
- 4, 19.
- 6, 19.
- 8, and 18.
- 11, and only self-managed installations need to take action since GitLab.
com and GitLab Dedicated are already running patched code. The same release also closed a lower-severity CSRF weakness in the GraphQL multiplex query handler, and no public exploit code or in-the-wild abuse of either bug has surfaced so far.