🚨 Critical GitLab GraphQL vulnerability: CVE-2026-19478 GitLab has released an out-of-band security patch for a CVSS 9.4 critical vulnerability affecting self-managed CE/EE installations. Under certain conditions, an unauthenticated remote attacker could use a malicious GraphQL directive to modify or delete public projects and user data. Affected branches include: • 18.2 → before 18.11.11 • 19.0 → before 19.0.8 • 19.1 → before 19.1.6 • 19.2 → before 19.2.4 GitLab also fixed CVE-2026-19650 (CVSS 7.1), a GraphQL multiplex-query CSRF issue that could allow unauthenticated mutation execution via GET requests under certain conditions. 🔧 Patch releases: 19.2.4 | 19.1.6 | 19.0.8 | 18.11.11 No public PoC or confirmed exploitation is currently disclosed but given the unauthenticated network attack surface and CVSS 9.4 rating, self-managed GitLab administrators should patch immediately. Full technical breakdown: https://thecybersecguru.com/news/cve-2026-19478-gitlab-graphql-vulnerability/ #GitLab #CVE202619478 #CVE202619650 #GraphQL #CyberSecurity #InfoSec #Vulnerability #AppSec #DevSecOps #GitLabSecurity