GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

Exploitation of this GIitLab code injection vulnerability has been reported. Immediate patching should be performed to protect against this threat.

GitLab CE/EE versions starting from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 is affected by an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

The version of GitLab installed on the remote host is affected by a vulnerability, as follows:

  - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0     before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an     unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
    (CVE-2026-19478)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3 advisory.

    Gitlab reports:
    Code Injection issue via GraphQL directive impacts GitLab CE/EE     Cross-Site Request Forgery issue in GraphQL multiplex query handler impacts GitLab CE/EE

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115439	GitLab 18.2 < 18.11.11 / 19.0 < 19.0.8 / 19.1 < 19.1.6 / 19.2 < 19.2.4 GraphQL Arbitrary Method Invocation	Web App Scanning	Component Vulnerability	Check Based	critical
337125	GitLab 18.2 < 18.11.11 / 19.0 < 19.0.8 / 19.1 < 19.1.6 / 19.2 < 19.2.4 (CVE-2026-19478)	Nessus	CGI abuses	Combined	critical
337101	FreeBSD : Gitlab -- Vulnerabilities (3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3)	Nessus	FreeBSD Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-19478

critical

Tenable Plugins

critical

critical

critical