type: cve · created: 2026-08-22 · updated: 2026-08-22 · tags: [cve, zero-day, kev, supply-chain] · confidence: high · severity: critical · affected_sectors: [technology, finance] · au_impact: true
GitLab CVE-2026-19478 (CVSS 9.4): an unauthenticated code-injection vulnerability exploitable via a GraphQL directive that lets an attacker modify or delete publicly accessible GitLab projects and rewrite data. Observed under active exploitation within days of disclosure (watchTowr). Patched in GitLab 19.2.4, 19.1.6, 19.0.8 and 18.11.11.