GitLab GraphQL Vulnerability Lets Unauthenticated Users Delete Public Projects

GitLab released security updates addressing a critical vulnerability affecting its Community Edition (CE) and Enterprise Edition (EE). The flaw, tracked as CVE‑2026‑19478, was rated Critical by GitLab and carries a CVSS score of 9.4. Attackers can craft malicious GraphQL queries that bypass authentication checks to modify or delete public projects and user data ¹.

Experts explain the flaw stems from improper input validation within the GraphQL API. A crafted query can bypass authentication and alter project metadata or remove entire repositories that are publicly accessible. Similar concepts were seen in CVE‑2018‑6973 against Elasticsearch where unverified users gained control over clusters via insecure REST APIs. This same pattern has been exploited before—for example CircleCI in 2017 (CVE‑2017‑9863), leading to unauthorized access and data exfiltration—highlighting a concerning trend for cloud services using complex APIs.

Open-source communities rely on GitLab to host codebases and build services such as CDNs. Public projects often contain sensitive information like credentials used for demonstration or testing purposes. Because many deployments run across various cloud providers worldwide—including AWS Elastic Container Service (ECS) and Azure Kubernetes Services (AKS)—patching is essential. Organizations should prioritize remediation immediately as exploitation could lead to significant data loss.