GitLab is dealing with active exploitation of a newly disclosed critical vulnerability, CVE-2026-19478, shortly after it becomes public. SecurityWeek reports that the flaw can be exploited without authentication to modify or delete public projects and related user data. The Hacker News also says the issue is being actively exploited within days of disclosure, citing watchTowr.
Across reporting, the vulnerability is described as having a high severity (CVSS 9.4) and involving code injection. The Hacker News notes that an unauthenticated attacker can rewrite data for publicly accessible projects under certain conditions, without needing to pass authentication checks. Together, the outlets describe the risk as immediate and practical for exposed GitLab instances, particularly those with public project visibility. While the specific technical exploitation steps are not fully detailed in the provided excerpts, both sources emphasize that the attacker does not require credentials and can affect project content and data integrity.
No outlet in the provided text attributes the activity to a specific threat actor, and details about mitigations are not included in the excerpts.
