Pre-auth GitLab writes outrank your branch rules: minutes to reproduce, two days to in-the-wild

GitLab shipped 19.2.4, 19.1.6, 19.0.8 and 18.11.11 for CE and EE on August 17, 2026, fixing CVE-2026-19478, a code injection issue via a GraphQL directive that under certain conditions lets an unauthenticated user remotely modify or delete public projects and user data ^[1][2]. By Wednesday, August 19, security firm watchTowr was reporting in-the-wild exploitation across its honeypot network ^[10], roughly two days from patch to observed attack traffic ^[1].

The interesting interval is shorter than that. Jake Knott, principal security researcher at watchTowr, told CSO Online the firm reproduced the vulnerability within minutes of disclosure, armed only with the advisory details and the patch ^[9]. The honeypot data does not fix the hour of the first attempt; it establishes that watchTowr was seeing exploitation by the 19th ^[10]. Knott's framing is that AI-enabled attackers compress disclosure-to-exploitation and that waiting for the next patch cycle is often too late ^[14]; GitLab's scheduled patches land on the second and fourth Wednesdays ^[7].

What the bug turns on is the direction of impact. The CVSS 9.4 vector reads C:L/I:H/A:H ^[3]: low confidentiality impact, high integrity and availability impact, which is a destructive write primitive rather than a data-theft one ^[2]. Per CSO Online, a single HTTP request with no credentials, no user interaction and no special configuration can rewrite repository state, forge merge records, ban maintainers and delete entire projects ^[12]. Protected branches and approval rules govern authenticated actors. A request that never authenticates is not subject to them. The companion fix, CVE-2026-19650, is a CSRF issue in the GraphQL multiplex query handler at CVSS 7.1, allowing unauthenticated mutations via GET but requiring user interaction ^[8].

Affected builds are everything from 18.2 below the four patch versions ^[4]. GitLab.com and Dedicated are already patched ^[5]. If you cannot upgrade now, CSO Online reports the advice is to make repositories private and block unauthenticated access to /api/graphql, and to grep logs for the string "@gl_introduced" ^[13][11].