CVE-2026-19650: GitLab Authentication Bypass Vulnerability

CVE-2026-19650 Overview

GitLab disclosed a request validation flaw in GitLab Community Edition (CE) and Enterprise Edition (EE) affecting the GraphQL multiplex query handler. Under specific conditions, an unauthenticated attacker can trigger GraphQL mutations through HTTP GET requests, bypassing the standard state-changing request controls. The issue is tracked as a Cross-Site Request Forgery weakness [CWE-352] and requires user interaction to execute successfully. GitLab remediated the issue across four release branches: 18.11.11, 19.0.8, 19.1.6, and 19.2.4.

Critical Impact
An unauthenticated attacker can coerce authenticated GitLab users into executing arbitrary GraphQL mutations through crafted GET requests, resulting in integrity impact to project data and repository state.

Affected Products

GitLab CE/EE versions 18.2 up to (but not including) 18.11.11
GitLab CE/EE versions 19.0 up to (but not including) 19.0.8
GitLab CE/EE versions 19.1 up to (but not including) 19.1.6 and 19.2 up to (but not including) 19.2.4

Discovery Timeline

2026-08-17 - CVE-2026-19650 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-19650

Vulnerability Analysis

GitLab exposes a GraphQL API that supports multiplexed queries, allowing clients to bundle multiple operations into a single request. The vulnerability stems from improper request validation in the multiplex query handler. The handler failed to enforce that mutations, which change server state, must use HTTP POST rather than GET.

Because GET requests are not protected by standard anti-CSRF mechanisms in the same way as POST requests, an attacker can construct a URL that embeds a GraphQL mutation. When a logged-in GitLab user visits an attacker-controlled page or follows a crafted link, the browser issues the GET request with the user's session cookies attached. GitLab then processes the embedded mutation as if the user initiated it.

The weakness is classified as [CWE-352] Cross-Site Request Forgery. Impact is limited to integrity and low availability; confidentiality is not directly affected because the response is returned to the victim's browser under the same-origin policy.

Root Cause

The root cause is missing method enforcement in the GraphQL multiplex endpoint. The endpoint accepted mutation operations regardless of the underlying HTTP verb, and CSRF token validation was not applied to GET-delivered mutations. Any state-changing GraphQL operation should be restricted to POST requests with a valid CSRF token, but this check was absent for the multiplex code path.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker crafts a URL targeting the GitLab GraphQL multiplex endpoint with a mutation payload encoded in the query string. The attacker then delivers the URL through phishing, an embedded HTML element such as an <img> or <iframe> on an attacker-controlled site, or a malicious link in a comment or issue. When an authenticated GitLab user triggers the request, the mutation executes with that user's privileges.

See the HackerOne Report #3903669 and GitLab Work Item #612617 for technical details.

Detection Methods for CVE-2026-19650

Indicators of Compromise

GET requests to /api/graphql or the multiplex endpoint containing mutation keywords in the query string
HTTP referrer headers pointing to external, untrusted domains for state-changing GraphQL calls
Unexpected changes to project settings, membership, tokens, or repository metadata following user web activity

Detection Strategies

Inspect web server and reverse proxy access logs for GraphQL requests using HTTP GET that include mutation operation names
Correlate GitLab audit events for configuration or permission changes against the initiating request method and referrer
Alert on cross-origin referrers submitting requests to /api/graphql endpoints

Monitoring Recommendations

Forward GitLab application logs, NGINX access logs, and audit events into a centralized analytics platform for query-based hunting
Baseline normal GraphQL traffic patterns and flag deviations such as GET-based mutations or spikes from single user accounts
Monitor for anomalous project membership additions, token creations, or webhook modifications tied to browser-driven sessions

How to Mitigate CVE-2026-19650

Immediate Actions Required

Upgrade self-managed GitLab instances to 18.11.11, 19.0.8, 19.1.6, or 19.2.4 depending on the deployed release branch
Review GitLab audit logs for suspicious mutations executed via GET requests since the affected versions were installed
Rotate personal access tokens, deploy tokens, and webhook secrets if unauthorized mutations are suspected

Patch Information

GitLab addressed the flaw in the patch releases documented in the GitLab Patch Release 19.2.4 advisory. The fix enforces that GraphQL mutations may only be executed through POST requests carrying valid CSRF protection, closing the multiplex handler bypass.

Workarounds

Restrict access to the GitLab GraphQL endpoint at the reverse proxy layer to trusted networks until patching is complete
Block HTTP GET requests to /api/graphql that contain the mutation keyword using a web application firewall rule
Enforce strict SameSite=Strict session cookie policies where operationally feasible to reduce cross-origin request abuse

bash

# Example NGINX rule to block GET-based GraphQL mutations
location /api/graphql {
    if ($request_method = GET) {
        if ($args ~* "mutation") {
            return 403;
        }
    }
    proxy_pass http://gitlab_upstream;
}