CVE-2026-19478: The 72-Hour GitLab GraphQL Catastrophe—Zero-Click Unauthenticated Project Deletion in the Wild + Video

By /

Listen to this Post

Featured Image

Introduction:

On August 17, 2026, GitLab released an emergency patch for CVE-2026-19478, a critical code injection vulnerability in its GraphQL API that allows unauthenticated attackers to modify or delete public projects and user data with a single crafted HTTP request. By August 20—just three days later—watchTowr’s honeypot network detected active in-the-wild exploitation. The vulnerability, scored 9.4 on the CVSS scale, stems from GitLab’s `@gl_introduced` GraphQL directive, which inadvertently allows attackers to invoke arbitrary Ruby methods on backend objects such as Projectdestroy. This incident underscores a new reality in vulnerability management: the window between patch disclosure and exploitation has compressed from weeks to hours, driven by AI-assisted reverse engineering of security fixes.

Learning Objectives & Secrets:

  • Objective 1: Understand the Root Cause – Grasp how GitLab’s `@gl_introduced` forward-compatibility directive creates a fallback field that invokes `object.public_send(field_name)` without re-checking authorization, enabling arbitrary zero-argument Ruby method execution.

  • Objective 2 Secret Tip: Detect Without Destructive Testing – Use a safe `touch` payload that merely updates a project’s `updated_at` timestamp to confirm vulnerability without causing data loss. A vulnerable instance returns "touch": true; a patched instance returns Field 'touch' doesn't exist on type 'Project'.

  • Objective 3 Secret Tip: Hunt Exploitation in Logs – Search web server logs for GraphQL requests containing `@gl_introduced` with version numbers higher than the running instance (e.g., 99.0.0). Watch for suspicious field names like destroy, delete, deactivate, block, or ban.

You Should Know:

  1. Technical Deep Dive: How the @gl_introduced Directive Became an Injection Primitive

GitLab ships a GraphQL client directive called `@gl_introduced(version: “X.Y.Z”)` for forward compatibility during rolling deployments. When a query references a field with a version newer than the running server, a tracer (Gitlab::Graphql::VersionFilter::IntroducedTracer) strips that field before static validation. The query validates successfully, but at execution time, GitLab re-runs the original document and lets unknown fields resolve to a fallback.

The bug resides in the fallback implementation (lib/gitlab/graphql/version_filter/future_field_fallback.rb, pre-patch):

def fallback_field(name:)
GraphQL::Schema::Field.new(owner: self, name: name, type: GraphQL::Types::Boolean, fallback_value: nil)  <-- no resolver
end

A `GraphQL::Schema::Field` with no resolver is resolved by graphql-ruby by calling `object.public_send(field_name)` on the underlying ActiveRecord model. The `fallback_value: nil` parameter is dead code—the `public_send` branch executes before the fallback value is ever consulted.

The Attack Chain:

  1. Attacker identifies a public project’s full path (e.g., group/subgroup/project) or a public user’s username.
  2. Attacker crafts a GraphQL query with @gl_introduced(version: "99.0.0")—a version higher than any running instance.
  3. The query requests a “future field” named after a destructive Ruby method, such as destroy, delete, deactivate, or block.
  4. GitLab resolves the public project object, then invokes `Projectdestroy` (or equivalent) without authentication checks.
  5. The project is deleted or modified—irreversibly in the case of destroy.

Affected Versions:

| Branch | Affected Versions | Fixed Version |

|–|-||

| 18.x | 18.2 through 18.11.10 | 18.11.11 |
| 19.0 | 19.0.0 through 19.0.7 | 19.0.8 |
| 19.1 | 19.1.0 through 19.1.5 | 19.1.6 |
| 19.2 | 19.2.0 through 19.2.3 | 19.2.4 |

2. Detection and Assessment: Identifying Vulnerable Instances

Method 1: Version Check (Passive)

 Check GitLab version via API (requires token, but works for authenticated assessment)
curl -s https://gitlab.example.com/api/v4/version -H "PRIVATE-TOKEN: your_token"

Check via /help page (often reveals version in footer)
curl -s https://gitlab.example.com/help | grep -i "gitlab version"

Method 2: Behavioral Check with Nuclei (Non-Destructive)

The ProjectDiscovery Nuclei community has released a detection template that safely invokes the `touch` method to confirm vulnerability without causing damage:

 Install nuclei if not already installed
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

Run the CVE-2026-19478 detection template
nuclei -t http/cves/2026/CVE-2026-19478.yaml -u https://gitlab.example.com

Method 3: Manual GraphQL Probe (Safe)

Send this benign GraphQL query to test vulnerability:

query {
project(fullPath: "group/public-project") {
id
touch @gl_introduced(version: "999.0.0")
}
}
  • Vulnerable response: `”touch”: true` (the method executed successfully)
  • Patched response: `Field ‘touch’ doesn’t exist on type ‘Project’`

3. Exploitation in Practice: What Attackers Are Doing

Multiple public PoC exploits have been released since August 18, 2024. The most widely referenced implementation is davkharrr/CVE-2026-19478-PoC:

 Clone the PoC
git clone https://github.com/davkharrr/CVE-2026-19478-PoC.git
cd CVE-2026-19478-PoC

Safe check (calls Projecttouch)
python3 poc.py --url https://gitlab.example.com --project group/public-project

Destructive - deactivate a user (reversible)
python3 poc.py --url https://gitlab.example.com --user victim --mode modify

Destructive - delete a public project (IRREVERSIBLE)
python3 poc.py --url https://gitlab.example.com --project group/public-project --mode destroy

Attackers can also:

  • Delete entire repositories
  • Forge merge records to make it appear as if a fix landed when it didn’t
  • Ban project maintainers
  • Deactivate or block user accounts

4. Immediate Mitigation: Patching and Workarounds

Primary Remediation: Upgrade Immediately

 For Omnibus installations
sudo apt-get update && sudo apt-get install gitlab-ee=19.2.4-ee.0
 or
sudo yum install gitlab-ee-19.2.4-ee.0.el8.x86_64

For source installations
cd /home/git/gitlab
sudo -u git -H git checkout v19.2.4-ee

Workaround: Block Unauthenticated Access to /api/graphql

If immediate patching is impossible, restrict unauthenticated access to the GraphQL endpoint:

Nginx (fronting GitLab):

location /api/graphql {
 Allow only authenticated requests
auth_request /auth/check;

Or block all unauthenticated requests
if ($http_authorization = "") {
return 403;
}
proxy_pass http://gitlab-backend;
}

AWS WAF / CloudFront:

{
"Name": "BlockUnauthenticatedGraphQL",
"Priority": 0,
"Statement": {
"RateBasedStatement": {
"Limit": 10,
"AggregateKeyType": "IP",
"ScopeDownStatement": {
"ByteMatchStatement": {
"SearchString": "/api/graphql",
"FieldToMatch": { "UriPath": {} },
"TextTransformations": [],
"PositionalConstraint": "CONTAINS"
}
}
}
},
"Action": { "Block": {} }
}

Important: Blocking `/api/graphql` may break CI/CD pipelines and IDE integrations that rely on unauthenticated GraphQL introspection. Test thoroughly in staging before applying to production.

5. Log Forensics: Hunting for Compromise

Linux Log Analysis:

 Search Nginx logs for @gl_introduced directive usage
sudo grep -r "@gl_introduced" /var/log/nginx/.log

Search for destructive method names in GraphQL requests
sudo grep -E "(destroy|delete|deactivate|block|ban)" /var/log/nginx/.log | grep -i graphql

Check for unusual GraphQL request patterns (high volume, unusual user agents)
sudo awk '{print $1, $7, $12}' /var/log/nginx/access.log | grep "/api/graphql" | sort | uniq -c | sort -1r | head -20

Search GitLab production logs for the same indicators
sudo grep -r "@gl_introduced" /var/log/gitlab/gitlab-rails/.log
sudo grep -E "(destroy|delete|deactivate)" /var/log/gitlab/gitlab-rails/production.log | grep -i graphql

Windows (IIS):

 Find requests containing @gl_introduced
Select-String -Path "C:\inetpub\logs\LogFiles\W3SVC1.log" -Pattern "@gl_introduced"

Find destructive method calls
Select-String -Path "C:\inetpub\logs\LogFiles\W3SVC1.log" -Pattern "destroy|delete|deactivate|block|ban" | Select-String -Pattern "/api/graphql"

Key Indicators of Compromise (IoCs):

  • GraphQL requests containing `@gl_introduced(version:` with version > current running version
  • Field names in GraphQL queries that are not legitimate schema fields (destroy, delete, deactivate, block, ban, touch)
  • Unusually high volume of requests to `/api/graphql` from single IP addresses
  • Requests to `/api/graphql` with no authentication headers (for public projects)

6. The CSRF Sibling: CVE-2026-19650

The same patch release also addressed CVE-2026-19650, a high-severity (CVSS 7.1) CSRF vulnerability in GitLab’s GraphQL multiplex query handler. This flaw allows an attacker to execute GraphQL mutations via GET requests, bypassing traditional POST-based CSRF protections. While CVE-2026-19478 requires no user interaction, CVE-2026-19650 requires tricking an authenticated user’s browser into sending a request. Both vulnerabilities affect the same version ranges and are fixed in the same releases.

What Undercode Say:

  • Key Takeaway 1: The “Patch Tuesday” Mentality Is Obsolete. Three days from patch to active exploitation is not an anomaly—it’s the new baseline. AI-assisted reverse engineering of security patches has compressed the window to hours or minutes. Organizations still operating on monthly or quarterly patch cycles are effectively running production environments with known, exploitable vulnerabilities for weeks at a time.

  • Key Takeaway 2: Bug Bounty Programs Work—But Speed Kills. The fact that hiimguardian discovered and reported this flaw through GitLab’s HackerOne program demonstrates the effectiveness of coordinated disclosure. However, the three-day gap between patch release and exploitation proves that responsible disclosure alone is insufficient. Security teams must have the capability to deploy emergency patches within hours, not days. The attack surface of modern DevSecOps platforms—with GraphQL APIs, CI/CD integrations, and public-facing project directories—demands a fundamentally faster response posture.

Prediction:

  • -1 The 72-hour exploit window will continue to shrink. By 2027, we can expect AI-powered exploitation tools to generate working PoC code within minutes of patch release, reducing the window to under 24 hours for critical vulnerabilities. Organizations without automated, zero-touch patching pipelines will face existential risk.

  • -1 GraphQL APIs will become a primary attack vector in 2026-2027. The flexibility that makes GraphQL powerful—custom queries, directive-based filtering, and introspection—also creates a vast attack surface that traditional WAFs and API gateways are ill-equipped to protect.

  • +1 The GitLab incident will accelerate adoption of “patch-as-code” and automated emergency response frameworks. Security teams will invest in AI-assisted vulnerability reproduction tools (like those used by watchTowr) to proactively test their own environments before attackers can exploit them.

  • +1 Bug bounty programs will gain renewed investment as the most effective early-warning system for zero-day vulnerabilities. The hiimguardian disclosure demonstrates that crowdsourced security research remains one of the fastest paths to vulnerability discovery and remediation.

  • -1 Public project visibility on DevSecOps platforms will come under renewed scrutiny. Organizations may begin restricting public project creation or requiring explicit approvals, reversing the trend toward open-by-default collaboration in the name of security hygiene.

▶️ Related Video (84% Match):

https://www.youtube.com/watch?v=6zXPSQG1AE0

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/ewJBKvkb – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: