Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects

Reports

5

Domains carrying it

4

First reported

17 August 2026

Latest report

21 August 2026

◆ Sectors

◆ Timeline

1. 17 August 2026Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projectsthehackernews.com
2. 19 August 2026GitLab Rushes Out Patch For Flaw That Let Anyone Delete Your Projectsstartupfortune.com
3. 21 August 2026GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosurethehackernews.com
4. 21 August 2026Critical GitLab vulnerability exploited days after disclosurefieldeffect.com

◆ Connected developments

Situations Wire finds semantically close to this one. Proximity, not cause.

• Critical ServiceNow code execution flaw now exploited in attacks3 reports · 3 domains · 21 July 2026
• Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In4 reports · 3 domains · 6 August 2026
• GitLab Scales Agentic AI Across Trusted Software Delivery Workflows2 reports · 2 domains · 21 August 2026
• GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption7 reports · 7 domains · 31 July 2026
• 21000 Exchange Servers Exposed to Public PoC Exploit After Pwn2Own $200K Chain Demo2 reports · 2 domains · 4 September 2026
• Critical Progress LoadMaster flaw now actively exploited in attacks2 reports · 2 domains · 10 August 2026

◆ Share

◆ Evidence

5 reports · 4 domains

• Critical GitLab vulnerability exploited days after disclosurefieldeffect.com · 21 August 2026
• GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosurethehackernews.com · 21 August 2026
• Critical and High-Severity GraphQL CVEs in GitLab: Code Injection and CSRF via One Directiveox.security · 19 August 2026
• GitLab Rushes Out Patch For Flaw That Let Anyone Delete Your Projectsstartupfortune.com · 19 August 2026
• Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projectsthehackernews.com · 17 August 2026