GitLab CVE-2026-19478 Code Injection Actively Exploited Days After Disclosure

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Act: GitLab is a core CI/CD asset in most engineering environments; this unauthenticated code-injection flaw (CVSS 9.4) with a public PoC is already being weaponized. Patch all self-hosted GitLab instances to the vendor’s fixed version immediately and audit recently modified public projects for unexpected data rewrites.
SOC/IR — Act: Active exploitation of a GitLab code-injection flaw means assume-compromise posture for any internet-exposed self-hosted instance: hunt GitLab audit logs for unauthenticated modification or deletion events against public projects since the disclosure date, and alert engineering if anomalies are found.
Leader — Plan: A critically-rated, actively exploited flaw in a widely-used CI/CD platform carries supply-chain risk if projects were tampered with before patching; confirm with engineering that all GitLab deployments are patched this week and assess whether any customer-facing build artifacts could have been affected.
Signals: CVE-2026-19478 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub

Cicd-Security on CuraSec