Security researchers are highly concerned about the out-of-band patch GitLab released on Monday, which addresses a code injection vulnerability rated as "critical." This vulnerability allows attackers to remotely modify or delete public projects and user data via GraphQL directives, with a CVSS score of 9.4 out of 10.

The vulnerability is numbered CVE-2026-19478, initially reported through the HackerOne bug bounty program. GitLab released an out-of-band update on Monday to address this risk.

Threat intelligence company watchTowr warned on Tuesday that it successfully reproduced the vulnerability within minutes of public disclosure. Researchers noted that attackers exploiting this vulnerability could cause severe damage.

"The newly disclosed code injection vulnerability allows unauthenticated attackers to delete publicly accessible GitLab projects and rewrite their status," said Jake Knott, chief security researcher at watchTowr. Attackers can execute a series of malicious operations via a single HTTP request, including deleting entire repositories, forging merge records, or banning maintainers, without any credentials or user interaction.

Knott advised that organizations running internet-facing self-hosted GitLab instances should immediately upgrade to the patched version. If immediate upgrade is not possible, restrict unauthenticated access to "api/graphql"; as a last resort, remove access to public repositories.

watchTowr researchers confirmed on Wednesday that they observed in-the-wild exploitation of this vulnerability in their honeypot network. "This is the new reality of vulnerability reproduction and exploitation—AI-driven attackers can compress the time from disclosure to exploitation to an extremely short window. Waiting for the next patch cycle is often too late," Knott added.

Security teams that have not yet completed patching should check web logs for requests containing "gl_introduced" and investigate for signs of probing.

Additionally, this GitLab release also fixed a cross-site request forgery vulnerability, numbered CVE-2026-19650. Under specific conditions, attackers could perform mutations via GET requests.

Editor's note: This article includes additional comments from watchTowr.