GitLab CE/EE Unauthenticated GraphQL Directive Code Injection via @gl_introduced

#!/usr/bin/env bash
# check_cve_2026_19478.sh — Detect CVE-2026-19478 (GitLab GraphQL directive injection)
# Run on target GitLab host as root or a user with read access to version files.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

get_version() {
  # Try version-manifest first (Omnibus)
  if [[ -f /opt/gitlab/version-manifest.txt ]]; then
    head -1 /opt/gitlab/version-manifest.txt | awk '{print $2}'
    return
  fi
  # Try dpkg (Debian/Ubuntu)
  if command -v dpkg &>/dev/null; then
    local v
    v=$(dpkg -l gitlab-ce gitlab-ee 2>/dev/null | awk '/^ii/{print $3}' | head -1 | sed 's/-.*//')
    [[ -n "$v" ]] && echo "$v" && return
  fi
  # Try rpm (RHEL/CentOS)
  if command -v rpm &>/dev/null; then
    local v
    v=$(rpm -q gitlab-ce gitlab-ee 2>/dev/null | grep -v 'not installed' | head -1 | sed 's/gitlab-[ce]e-//;s/-.*//')
    [[ -n "$v" ]] && echo "$v" && return
  fi
  # Try gitlab-rake
  if command -v gitlab-rake &>/dev/null; then
    gitlab-rake gitlab:env:info 2>/dev/null | grep 'GitLab:' | awk '{print $2}'
    return
  fi
  echo ""
}

version_gte() {
  # Returns 0 if $1 >= $2 using sort -V
  [[ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -1)" == "$2" ]]
}

VERSION=$(get_version)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — Could not determine GitLab version. Is this a GitLab host?"
  exit 2
fi

echo "Detected GitLab version: $VERSION"

# Parse major.minor
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)

# Not affected: versions before 18.2
if [[ "$MAJOR" -lt 18 ]] || { [[ "$MAJOR" -eq 18 ]] && [[ "$MINOR" -lt 2 ]]; }; then
  echo "PATCHED — Version $VERSION is not in the affected range (pre-18.2)."
  exit 0
fi

# Branch: 18.x
if [[ "$MAJOR" -eq 18 ]]; then
  if version_gte "$VERSION" "18.11.11"; then
    echo "PATCHED — Version $VERSION >= 18.11.11."
    exit 0
  else
    echo "VULNERABLE — Version $VERSION is in affected range 18.2–18.11.10. Upgrade to 18.11.11+."
    exit 1
  fi
fi

# Branch: 19.0.x
if [[ "$MAJOR" -eq 19 ]] && [[ "$MINOR" -eq 0 ]]; then
  if version_gte "$VERSION" "19.0.8"; then
    echo "PATCHED — Version $VERSION >= 19.0.8."
    exit 0
  else
    echo "VULNERABLE — Version $VERSION is in affected range 19.0.0–19.0.7. Upgrade to 19.0.8+."
    exit 1
  fi
fi

# Branch: 19.1.x
if [[ "$MAJOR" -eq 19 ]] && [[ "$MINOR" -eq 1 ]]; then
  if version_gte "$VERSION" "19.1.6"; then
    echo "PATCHED — Version $VERSION >= 19.1.6."
    exit 0
  else
    echo "VULNERABLE — Version $VERSION is in affected range 19.1.0–19.1.5. Upgrade to 19.1.6+."
    exit 1
  fi
fi

# Branch: 19.2.x
if [[ "$MAJOR" -eq 19 ]] && [[ "$MINOR" -eq 2 ]]; then
  if version_gte "$VERSION" "19.2.4"; then
    echo "PATCHED — Version $VERSION >= 19.2.4."
    exit 0
  else
    echo "VULNERABLE — Version $VERSION is in affected range 19.2.0–19.2.3. Upgrade to 19.2.4+."
    exit 1
  fi
fi

# 19.3+ should include the fix
if [[ "$MAJOR" -eq 19 ]] && [[ "$MINOR" -ge 3 ]]; then
  echo "PATCHED — Version $VERSION is beyond the affected branches."
  exit 0
fi

if [[ "$MAJOR" -ge 20 ]]; then
  echo "PATCHED — Version $VERSION is beyond the affected branches."
  exit 0
fi

echo "UNKNOWN — Could not classify version $VERSION. Manual review required."
exit 2