GitLab 紧急修复高危代码注入漏洞,watchTowr 警告野外利用已出现
GitLab 于周一发布带外安全补丁,修复一个被追踪为 CVE-2026-19478 的严重代码注入漏洞,该漏洞可允许未认证攻击者通过 GraphQL 指令远程修改或删除公共项目及用户数据,CVSS 评分为 9.4。威胁情报公司 watchTowr 在公开披露后数分钟内即复现漏洞,并确认已出现野外利用。

Security researchers are highly concerned about the out-of-band patch GitLab released on Monday, which addresses a code injection vulnerability rated as "critical." This vulnerability allows attackers to remotely modify or delete public projects and user data via GraphQL directives, with a CVSS score of 9.4 out of 10.
The vulnerability is numbered CVE-2026-19478, initially reported through the HackerOne bug bounty program. GitLab released an out-of-band update on Monday to address this risk.
Threat intelligence company watchTowr warned on Tuesday that it successfully reproduced the vulnerability within minutes of public disclosure. Researchers noted that attackers exploiting this vulnerability could cause severe damage.
"The newly disclosed code injection vulnerability allows unauthenticated attackers to delete publicly accessible GitLab projects and rewrite their status," said Jake Knott, chief security researcher at watchTowr. Attackers can execute a series of malicious operations via a single HTTP request, including deleting entire repositories, forging merge records, or banning maintainers, without any credentials or user interaction.
Knott advised that organizations running internet-facing self-hosted GitLab instances should immediately upgrade to the patched version. If immediate upgrade is not possible, restrict unauthenticated access to "api/graphql"; as a last resort, remove access to public repositories.
watchTowr researchers confirmed on Wednesday that they observed in-the-wild exploitation of this vulnerability in their honeypot network. "This is the new reality of vulnerability reproduction and exploitation—AI-driven attackers can compress the time from disclosure to exploitation to an extremely short window. Waiting for the next patch cycle is often too late," Knott added.
Security teams that have not yet completed patching should check web logs for requests containing "gl_introduced" and investigate for signs of probing.
Additionally, this GitLab release also fixed a cross-site request forgery vulnerability, numbered CVE-2026-19650. Under specific conditions, attackers could perform mutations via GET requests.
Editor's note: This article includes additional comments from watchTowr.