{"schema":"vulnpedia.poc/1","cve":"CVE-2026-19478","generated":"2026-10-26T06:59:15.268Z","kev":null,"epss":{"score":0.02155,"percentile":0.82043},"cvss":{"version":"3.1","score":9.4,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"},"has_public_poc":true,"poc_sources":[{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/20ec5b3a43f5","executable":false,"sourceId":"20ec5b3a43f5","verification":"catalogued","source":"vulncheck-kev","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"20ec5b3a43f5","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/20ec5b3a43f5"}],"repositoryUrl":"https://github.com/davkharrr/CVE-2026-19478-PoC"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/9d73feb6058c","executable":false,"sourceId":"9d73feb6058c","verification":"catalogued","source":"vulncheck-kev","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9d73feb6058c","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/9d73feb6058c"}],"repositoryUrl":"https://github.com/renzi25031469/CVE-2026-19478"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/5945d183b18f","executable":false,"sourceId":"5945d183b18f","verification":"catalogued","source":"vulncheck-kev","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"5945d183b18f","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/5945d183b18f"}],"repositoryUrl":"https://github.com/n0xdaemon/cve-2026-19478"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/5f4dec31eb04","executable":false,"sourceId":"5f4dec31eb04","verification":"catalogued","source":"vulncheck-kev","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"5f4dec31eb04","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/5f4dec31eb04"}],"repositoryUrl":"https://github.com/dinosn/gitlab-cve-2026-19478-lab"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/0b0f4304735b","executable":false,"sourceId":"0b0f4304735b","verification":"catalogued","source":"vulncheck-kev","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0b0f4304735b","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/0b0f4304735b"}],"repositoryUrl":"https://github.com/punitdarji/Gitlab-CVE-2026-19478"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/637796c5f0a2","executable":false,"sourceId":"637796c5f0a2","verification":"catalogued","source":"vulncheck-kev","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"637796c5f0a2","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/637796c5f0a2"}],"repositoryUrl":"https://github.com/EQSTLab/CVE-2026-19478"}],"poc_candidates":[{"url":"https://github.com/davkharrr/CVE-2026-19478-PoC","source":"poc-in-github","sourceId":"CVE-2026-19478","description":"CVE-2026-19478 PoC . Unauthenticated remote code-injection in GitLab's GraphQL layer ","modified":"2026-09-12T09:14:07Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-19478","url":"https://github.com/davkharrr/CVE-2026-19478-PoC"},{"source":"poc-in-github","sourceId":"CVE-2026-19478","modified":"2026-09-12T09:14:07Z","url":"https://github.com/davkharrr/CVE-2026-19478-PoC"}],"tags":[]},{"url":"https://github.com/dinosn/gitlab-cve-2026-19478-lab","source":"poc-in-github","sourceId":"CVE-2026-19478","description":"Reproducible A/B lab + safe PoC for GitLab CVE-2026-19478 / CVE-2026-19650 (GraphQL @gl_introduced)","modified":"2026-10-02T20:31:57Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-19478","url":"https://github.com/dinosn/gitlab-cve-2026-19478-lab"},{"source":"poc-in-github","sourceId":"CVE-2026-19478","modified":"2026-10-02T20:31:57Z","url":"https://github.com/dinosn/gitlab-cve-2026-19478-lab"}],"tags":[]},{"url":"https://github.com/renzi25031469/CVE-2026-19478","source":"poc-in-github","sourceId":"CVE-2026-19478","description":"Nuclei detection template for CVE-2026-19478, a critical (CVSS 9.4) unauthenticated arbitrary method invocation flaw in the GitLab GraphQL API,","modified":"2026-10-08T15:37:20Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-19478","url":"https://github.com/renzi25031469/CVE-2026-19478"},{"source":"poc-in-github","sourceId":"CVE-2026-19478","modified":"2026-10-08T15:37:20Z","url":"https://github.com/renzi25031469/CVE-2026-19478"}],"tags":[]},{"url":"https://github.com/n0xdaemon/cve-2026-19478","source":"poc-in-github","sourceId":"CVE-2026-19478","description":"CVE-2026-19478: GitLab GraphQL Vulnerability PoC","modified":"2026-08-21T21:07:08Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-19478","url":"https://github.com/n0xdaemon/cve-2026-19478"},{"source":"poc-in-github","sourceId":"CVE-2026-19478","modified":"2026-08-21T21:07:08Z","url":"https://github.com/n0xdaemon/cve-2026-19478"}],"tags":[]},{"url":"https://github.com/EQSTLab/CVE-2026-19478","source":"poc-in-github","sourceId":"CVE-2026-19478","description":"GitLab Code injection","modified":"2026-10-24T11:48:27Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-19478","url":"https://github.com/EQSTLab/CVE-2026-19478"},{"source":"poc-in-github","sourceId":"CVE-2026-19478","modified":"2026-10-24T11:48:27Z","url":"https://github.com/EQSTLab/CVE-2026-19478"}],"tags":[]}],"test_commands":[{"tool":"nuclei","cmd":"nuclei -id CVE-2026-19478 -u https://TARGET","note":"Detection template — review its checks and affected versions before use."},{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2026-19478/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}],"detection_sources":[{"kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19478.yaml","template":"http/cves/2026/CVE-2026-19478.yaml","executable":true}],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2026-19478%22&type=repositories","executable":false}]}