CVE-2026-4922: GitLab GraphQL CSRF Vulnerability

CVE-2026-4922 Overview

CVE-2026-4922 is a Cross-Site Request Forgery (CSRF) vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability exists due to insufficient CSRF protection in the GraphQL API, which could allow an unauthenticated attacker to execute GraphQL mutations on behalf of authenticated users. This flaw affects all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1.

Critical Impact

Unauthenticated attackers can perform privileged actions by exploiting CSRF weaknesses in GitLab's GraphQL endpoint, potentially leading to unauthorized data modification, repository changes, or account compromise when a victim visits a malicious page while authenticated to GitLab.

Affected Products

• GitLab Community Edition (CE) versions 17.0 to 18.9.5
• GitLab Enterprise Edition (EE) versions 17.0 to 18.9.5
• GitLab CE/EE versions 18.10 to 18.10.3
• GitLab CE/EE version 18.11.0

Discovery Timeline

• 2026-04-22 - CVE-2026-4922 published to NVD
• 2026-04-22 - GitLab releases security patch (versions 18.11.1, 18.10.4, and 18.9.6)
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-4922

Vulnerability Analysis

This vulnerability stems from inadequate Cross-Site Request Forgery (CSRF) protection mechanisms in GitLab's GraphQL API implementation. GitLab's GraphQL endpoint allows authenticated users to perform various mutations that modify data within the platform—including repository settings, project configurations, user permissions, and more. When CSRF protections are insufficient, attackers can craft malicious web pages that trigger these mutations in the context of a victim's authenticated session.

The attack requires user interaction: a victim must be logged into GitLab and visit an attacker-controlled web page or click a malicious link. The attacker's page can then silently submit GraphQL mutation requests to the GitLab instance, and because the victim's browser automatically includes authentication cookies, the mutations execute with the victim's privileges.

Root Cause

The root cause is classified under CWE-352 (Cross-Site Request Forgery). GitLab's GraphQL mutation endpoints failed to properly validate CSRF tokens or implement adequate same-origin request verification. This allowed cross-origin requests carrying the victim's session credentials to be processed as legitimate authenticated requests.

Proper CSRF protection typically involves validating anti-CSRF tokens on state-changing requests, checking the Origin or Referer headers, or using SameSite cookie attributes. The vulnerability indicates one or more of these mechanisms were missing or improperly implemented for GraphQL mutation operations.

Attack Vector

The attack is network-based and requires user interaction. An attacker would craft a malicious webpage containing JavaScript or form elements that submit GraphQL mutations to the target GitLab instance. When an authenticated GitLab user visits this page, their browser automatically sends session cookies along with the forged requests.

The attacker could leverage this to perform actions such as modifying project settings, adding SSH keys to a user's account, changing repository visibility, or altering CI/CD configurations—all without the victim's knowledge or consent.

The vulnerability mechanism involves insufficient validation of cross-origin GraphQL requests. For technical details regarding the specific implementation flaw, refer to the GitLab work item and the HackerOne vulnerability report.

Detection Methods for CVE-2026-4922

Indicators of Compromise

• Unexpected GraphQL mutation requests originating from external referrers in GitLab application logs
• Unauthorized changes to repository settings, user SSH keys, or project configurations without corresponding UI activity
• Anomalous GraphQL API activity patterns, particularly mutations executed without corresponding user navigation events
• User reports of unexpected account or repository modifications

Detection Strategies

• Monitor GitLab application logs for GraphQL mutations with suspicious Referer or Origin headers that don't match legitimate GitLab domains
• Implement anomaly detection for GraphQL API usage patterns, flagging mutations from unusual referrer sources
• Review audit logs for configuration changes that lack corresponding user interaction context
• Deploy web application firewall (WAF) rules to detect and alert on potential CSRF attack patterns targeting GraphQL endpoints

Monitoring Recommendations

• Enable detailed logging for GitLab GraphQL API endpoints to capture request origins and referrer information
• Configure alerting on audit log events for sensitive mutations such as SSH key additions, project permission changes, and CI/CD configuration modifications
• Implement session monitoring to correlate user activity patterns with GraphQL mutation requests
• Consider deploying SentinelOne Singularity XDR to provide comprehensive visibility into web application threats and CSRF attack attempts

How to Mitigate CVE-2026-4922

Immediate Actions Required

• Upgrade GitLab CE/EE to patched versions immediately: 18.11.1, 18.10.4, or 18.9.6 depending on your release branch
• Review audit logs for any suspicious GraphQL-initiated changes that may indicate prior exploitation
• Instruct users to review their account settings for unauthorized SSH keys or API tokens
• Consider temporarily restricting external network access to GitLab instances until patching is complete

Patch Information

GitLab has released patched versions addressing this vulnerability. Organizations should upgrade to one of the following fixed versions:

• Version 18.11.1 - For installations on the 18.11.x release branch
• Version 18.10.4 - For installations on the 18.10.x release branch
• Version 18.9.6 - For installations on the 18.9.x and earlier 17.x/18.x branches

Refer to the GitLab Patch Release Notes for detailed upgrade instructions and additional security fixes included in these releases.

Workarounds

• Implement network-level access controls to restrict GitLab access to trusted networks or VPN connections only
• Deploy a web application firewall (WAF) with rules to block requests with suspicious cross-origin characteristics to GraphQL endpoints
• Educate users about the risks of clicking untrusted links while authenticated to GitLab
• Consider implementing additional authentication requirements (such as re-authentication) for sensitive GraphQL mutations at the reverse proxy level

# Example: Verify GitLab version after patching
gitlab-rake gitlab:env:info | grep -i version

# Example: Review recent GraphQL activity in logs
grep -i "graphql" /var/log/gitlab/gitlab-rails/production.log | grep -i "mutation"