{"schema":"vulnpedia.research/1","cve":"CVE-2026-19478","references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/611377","tags":["Not Applicable"],"source":"mitre","sourceId":"GitLab","modified":"2026-08-17T20:04:46.400Z","origins":[{"source":"mitre","sourceId":"GitLab","modified":"2026-08-17T20:04:46.400Z","url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/611377"},{"source":"nvd","sourceId":"CVE-2026-19478","modified":"2026-09-02T12:43:20.490","url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/611377"}]},{"url":"https://hackerone.com/reports/3926431","tags":["technical-description","exploit","permissions-required","Permissions Required"],"source":"mitre","sourceId":"GitLab","modified":"2026-08-17T20:04:46.400Z","origins":[{"source":"mitre","sourceId":"GitLab","modified":"2026-08-17T20:04:46.400Z","url":"https://hackerone.com/reports/3926431"},{"source":"nvd","sourceId":"CVE-2026-19478","modified":"2026-09-02T12:43:20.490","url":"https://hackerone.com/reports/3926431"}]},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/","tags":["Vendor Advisory"],"source":"mitre","sourceId":"GitLab","modified":"2026-08-17T20:04:46.400Z","origins":[{"source":"mitre","sourceId":"GitLab","modified":"2026-08-17T20:04:46.400Z","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/"},{"source":"nvd","sourceId":"CVE-2026-19478","modified":"2026-09-02T12:43:20.490","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/"}]},{"source":"euvd","sourceId":"EUVD-2026-60443","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60443","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-60443","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60443"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://www.govinfosecurity.com/gitlab-code-injection-flaw-exploited-in-wild-a-32606","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","url":"https://www.govinfosecurity.com/gitlab-code-injection-flaw-exploited-in-wild-a-32606"}]},{"url":"https://cydome.io/maritime-cybersecurity-bulletin-august-21st-2026/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","url":"https://cydome.io/maritime-cybersecurity-bulletin-august-21st-2026/"}]},{"url":"https://previdian.com/CVE-2026-19478","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","url":"https://previdian.com/CVE-2026-19478"}]},{"url":"https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","url":"https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/"}]},{"url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape"}]},{"url":"https://vulncheck.com/xdb/20ec5b3a43f5","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"20ec5b3a43f5","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"20ec5b3a43f5","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/20ec5b3a43f5"}]},{"url":"https://github.com/davkharrr/CVE-2026-19478-PoC","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"20ec5b3a43f5","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"20ec5b3a43f5","modified":"2026-08-19T00:00:00Z","url":"https://github.com/davkharrr/CVE-2026-19478-PoC"}]},{"url":"https://vulncheck.com/xdb/9d73feb6058c","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"9d73feb6058c","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9d73feb6058c","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/9d73feb6058c"}]},{"url":"https://github.com/renzi25031469/CVE-2026-19478","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"9d73feb6058c","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9d73feb6058c","modified":"2026-08-19T00:00:00Z","url":"https://github.com/renzi25031469/CVE-2026-19478"}]},{"url":"https://vulncheck.com/xdb/5945d183b18f","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"5945d183b18f","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"5945d183b18f","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/5945d183b18f"}]},{"url":"https://github.com/n0xdaemon/cve-2026-19478","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"5945d183b18f","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"5945d183b18f","modified":"2026-08-19T00:00:00Z","url":"https://github.com/n0xdaemon/cve-2026-19478"}]},{"url":"https://vulncheck.com/xdb/5f4dec31eb04","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"5f4dec31eb04","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"5f4dec31eb04","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/5f4dec31eb04"}]},{"url":"https://github.com/dinosn/gitlab-cve-2026-19478-lab","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"5f4dec31eb04","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"5f4dec31eb04","modified":"2026-08-19T00:00:00Z","url":"https://github.com/dinosn/gitlab-cve-2026-19478-lab"}]},{"url":"https://vulncheck.com/xdb/0b0f4304735b","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"0b0f4304735b","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0b0f4304735b","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/0b0f4304735b"}]},{"url":"https://github.com/punitdarji/Gitlab-CVE-2026-19478","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"0b0f4304735b","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0b0f4304735b","modified":"2026-08-19T00:00:00Z","url":"https://github.com/punitdarji/Gitlab-CVE-2026-19478"}]},{"url":"https://vulncheck.com/xdb/637796c5f0a2","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"637796c5f0a2","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"637796c5f0a2","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/637796c5f0a2"}]},{"url":"https://github.com/EQSTLab/CVE-2026-19478","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"637796c5f0a2","modified":"2026-08-19T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"637796c5f0a2","modified":"2026-08-19T00:00:00Z","url":"https://github.com/EQSTLab/CVE-2026-19478"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/davkharrr/CVE-2026-19478-PoC","source":"poc-in-github","sourceId":"CVE-2026-19478","description":"CVE-2026-19478 PoC . Unauthenticated remote code-injection in GitLab's GraphQL layer ","modified":"2026-09-12T09:14:07Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-19478","url":"https://github.com/davkharrr/CVE-2026-19478-PoC"},{"source":"poc-in-github","sourceId":"CVE-2026-19478","modified":"2026-09-12T09:14:07Z","url":"https://github.com/davkharrr/CVE-2026-19478-PoC"}],"tags":[]},{"url":"https://github.com/dinosn/gitlab-cve-2026-19478-lab","source":"poc-in-github","sourceId":"CVE-2026-19478","description":"Reproducible A/B lab + safe PoC for GitLab CVE-2026-19478 / CVE-2026-19650 (GraphQL @gl_introduced)","modified":"2026-10-02T20:31:57Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-19478","url":"https://github.com/dinosn/gitlab-cve-2026-19478-lab"},{"source":"poc-in-github","sourceId":"CVE-2026-19478","modified":"2026-10-02T20:31:57Z","url":"https://github.com/dinosn/gitlab-cve-2026-19478-lab"}],"tags":[]},{"url":"https://github.com/renzi25031469/CVE-2026-19478","source":"poc-in-github","sourceId":"CVE-2026-19478","description":"Nuclei detection template for CVE-2026-19478, a critical (CVSS 9.4) unauthenticated arbitrary method invocation flaw in the GitLab GraphQL API,","modified":"2026-10-08T15:37:20Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-19478","url":"https://github.com/renzi25031469/CVE-2026-19478"},{"source":"poc-in-github","sourceId":"CVE-2026-19478","modified":"2026-10-08T15:37:20Z","url":"https://github.com/renzi25031469/CVE-2026-19478"}],"tags":[]},{"url":"https://github.com/n0xdaemon/cve-2026-19478","source":"poc-in-github","sourceId":"CVE-2026-19478","description":"CVE-2026-19478: GitLab GraphQL Vulnerability PoC","modified":"2026-08-21T21:07:08Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-19478","url":"https://github.com/n0xdaemon/cve-2026-19478"},{"source":"poc-in-github","sourceId":"CVE-2026-19478","modified":"2026-08-21T21:07:08Z","url":"https://github.com/n0xdaemon/cve-2026-19478"}],"tags":[]},{"url":"https://github.com/EQSTLab/CVE-2026-19478","source":"poc-in-github","sourceId":"CVE-2026-19478","description":"GitLab Code injection","modified":"2026-10-24T11:48:27Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-19478","url":"https://github.com/EQSTLab/CVE-2026-19478"},{"source":"poc-in-github","sourceId":"CVE-2026-19478","modified":"2026-10-24T11:48:27Z","url":"https://github.com/EQSTLab/CVE-2026-19478"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"20ec5b3a43f5","url":"https://vulncheck.com/xdb/20ec5b3a43f5","cve":"CVE-2026-19478","dateAdded":"2026-08-18T21:07:56Z","modified":"2026-08-19T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/davkharrr/CVE-2026-19478-PoC","observations":[{"dateAdded":"2026-08-18T21:07:56Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"20ec5b3a43f5","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/20ec5b3a43f5"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"9d73feb6058c","url":"https://vulncheck.com/xdb/9d73feb6058c","cve":"CVE-2026-19478","dateAdded":"2026-08-19T06:24:11Z","modified":"2026-08-19T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/renzi25031469/CVE-2026-19478","observations":[{"dateAdded":"2026-08-19T06:24:11Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"9d73feb6058c","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/9d73feb6058c"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"5945d183b18f","url":"https://vulncheck.com/xdb/5945d183b18f","cve":"CVE-2026-19478","dateAdded":"2026-08-21T02:01:59Z","modified":"2026-08-19T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/n0xdaemon/cve-2026-19478","observations":[{"dateAdded":"2026-08-21T02:01:59Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"5945d183b18f","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/5945d183b18f"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"5f4dec31eb04","url":"https://vulncheck.com/xdb/5f4dec31eb04","cve":"CVE-2026-19478","dateAdded":"2026-08-24T04:58:44Z","modified":"2026-08-19T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/dinosn/gitlab-cve-2026-19478-lab","observations":[{"dateAdded":"2026-08-24T04:58:44Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"5f4dec31eb04","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/5f4dec31eb04"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"0b0f4304735b","url":"https://vulncheck.com/xdb/0b0f4304735b","cve":"CVE-2026-19478","dateAdded":"2026-08-24T05:05:42Z","modified":"2026-08-19T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/punitdarji/Gitlab-CVE-2026-19478","observations":[{"dateAdded":"2026-08-24T05:05:42Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"0b0f4304735b","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/0b0f4304735b"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"637796c5f0a2","url":"https://vulncheck.com/xdb/637796c5f0a2","cve":"CVE-2026-19478","dateAdded":"2026-08-28T02:53:35Z","modified":"2026-08-19T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/EQSTLab/CVE-2026-19478","observations":[{"dateAdded":"2026-08-28T02:53:35Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"637796c5f0a2","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/xdb/637796c5f0a2"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-08-19T00:00:00Z","modified":"2026-08-19T00:00:00Z","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"GitLab","product":"GitLab","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","modified":"2026-08-19T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","catalog":"VulnCheck KEV","kind":"report","url":"https://www.govinfosecurity.com/gitlab-code-injection-flaw-exploited-in-wild-a-32606","dateAdded":"2026-08-19T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","url":"https://www.govinfosecurity.com/gitlab-code-injection-flaw-exploited-in-wild-a-32606"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","catalog":"VulnCheck KEV","kind":"report","url":"https://cydome.io/maritime-cybersecurity-bulletin-august-21st-2026/","dateAdded":"2026-08-21T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","url":"https://cydome.io/maritime-cybersecurity-bulletin-august-21st-2026/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","url":"https://previdian.com/CVE-2026-19478"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","catalog":"VulnCheck KEV","kind":"report","url":"https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/","dateAdded":"2026-08-24T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","url":"https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","dateAdded":"2026-09-08T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-19478","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape"}]}]}