GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11

CVE-2026-19650 is a cross-site request forgery (CSRF) flaw in GitLab CE/EE's GraphQL multiplex query handler. The root cause is that the /api/graphql endpoint fails to enforce CSRF token validation when mutations are submitted as GET requests through the multiplex path, bypassing the POST+X-CSRF-Token requirement that normally gates state-changing operations. An attacker crafts a malicious URL or page; when an authenticated GitLab user visits it, the browser fires off GraphQL mutations — creating snippets, modifying project settings, or potentially altering CI/CD pipeline configurations — under the victim's session. Affected versions span 18.2 through 18.11.10, 19.0.0–19.0.7, 19.1.0–19.1.5, and 19.2.0–19.2.3. That is roughly 18 months of release trains.

GitLab rates this HIGH / 7.1, which is *directionally correct* but slightly understates the blast radius. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) captures the social-engineering prerequisite and the integrity impact, but it treats GitLab like a generic web app. In reality, GitLab is the CI/CD control plane: mutations against it can alter .gitlab-ci.yml, inject pipeline steps, exfiltrate CI/CD variables, or modify deploy-key ACLs. That supply-chain multiplier pushes the effective risk above 7.1 for any org running self-managed GitLab with privileged maintainers. noisgate nudges this to 7.5 HIGH.

Why this verdict

• User interaction is real friction but not a blocker. Phishing a GitLab developer or maintainer is well within commodity attacker capability — targeted campaigns against devops teams routinely achieve 5–15% click rates. The UI:R reduces mass exploitation but does not prevent targeted attacks.
• Role multiplier — CI/CD control plane. GitLab is not a generic web app; it is the build and deploy pipeline. Mutations that modify CI/CD variables, inject pipeline steps, or alter deploy keys have supply-chain-scale blast radius. This is the canonical high-value role (CI/CD + artifact stores) from the role catalog, meaning ≥10% of GitLab installs occupy this role by definition — the verdict floor is HIGH.
• Wide affected version range. Spanning 18.2 through 19.2 (~18 months of releases) means most self-managed instances are vulnerable unless they upgraded on patch day. Combined with 50K–80K internet-facing instances, the exposure population is substantial.
• SameSite cookie behavior provides partial mitigation. Modern browsers default to SameSite=Lax, which blocks cross-site subrequests but permits top-level navigation GETs — exactly the vector this CSRF uses. SameSite=Lax does NOT stop this attack for navigation-triggered GET requests.

Why not higher?

This is not CRITICAL because exploitation requires successful social engineering of an authenticated user — it cannot be automated at scale like a pre-auth RCE. The CVSS scope is Unchanged (S:U), meaning the attacker cannot escape the victim's permission boundary. An attacker who phishes a low-privilege user gets minimal impact. The chain only reaches supply-chain severity when the victim is a Maintainer/Owner, which narrows the high-impact target set.

Why not lower?

GitLab is a CI/CD platform by definition — the supply-chain blast radius when a Maintainer is targeted sets a HIGH floor that friction alone cannot breach. The affected version range is exceptionally wide (18 months), the exposure surface includes tens of thousands of internet-facing instances, and the CSRF pattern (GET-based mutation via multiplex) requires no attacker authentication or complexity. Dropping to MEDIUM would ignore the canonical high-value role of the affected component.

1. Restrict GraphQL API access via reverse proxy — Configure your reverse proxy (nginx, HAProxy, Cloudflare) to block GET requests to /api/graphql that contain mutation in query parameters. This surgically kills the CSRF vector without breaking normal GraphQL POST operations. Deploy within the noisgate mitigation SLA of 30 days for HIGH findings.
2. Enforce SameSite=Strict on GitLab session cookies — Override GitLab's session cookie SameSite attribute to Strict at the load balancer or reverse proxy level. This prevents cross-site navigation from sending session cookies, fully neutralizing the CSRF. Note: this will break legitimate cross-site login flows (OAuth redirects) — test thoroughly before deploying.
3. Scope CI/CD variables to protected branches only — Ensure all sensitive CI/CD variables are marked as *protected* and scoped to protected branches. This limits what a CSRF-driven pipeline injection can exfiltrate, even if the attacker modifies an unprotected branch's .gitlab-ci.yml.
4. Enable GitLab audit event streaming to SIEM — Stream GitLab audit events for project settings changes, CI/CD variable modifications, pipeline configuration changes, and deploy key additions to your SIEM. Alert on unusual mutation patterns to catch exploitation attempts post-click.

Run this script on any host with curl and network access to your GitLab instance. Invoke as: ./check_cve_2026_19650.sh https://gitlab.example.com. No authentication needed — it checks the GitLab version via the public API.

#!/usr/bin/env bash
# check_cve_2026_19650.sh — Check GitLab instance for CVE-2026-19650
# Usage: ./check_cve_2026_19650.sh <GITLAB_URL>
# Requires: curl, awk
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <GITLAB_URL>"
  exit 2
fi

GITLAB_URL="${1%/}"

# Fetch version from public API (no auth required if version API is exposed)
VERSION=$(curl -sf "${GITLAB_URL}/api/v4/version" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' || true)

if [ -z "$VERSION" ]; then
  # Try metadata endpoint as fallback
  VERSION=$(curl -sf "${GITLAB_URL}/api/v4/metadata" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' || true)
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not retrieve GitLab version from ${GITLAB_URL}"
  echo "The /api/v4/version endpoint may require authentication."
  echo "Manually check: Settings > Help > GitLab version"
  exit 2
fi

echo "Detected GitLab version: $VERSION"

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

VULNERABLE=0

# Affected: 18.2.0 - 18.11.10
if [ "$MAJOR" -eq 18 ] && [ "$MINOR" -ge 2 ]; then
  if [ "$MINOR" -lt 11 ]; then
    VULNERABLE=1
  elif [ "$MINOR" -eq 11 ] && [ "$PATCH" -lt 11 ]; then
    VULNERABLE=1
  fi
fi

# Affected: 19.0.0 - 19.0.7
if [ "$MAJOR" -eq 19 ] && [ "$MINOR" -eq 0 ] && [ "$PATCH" -lt 8 ]; then
  VULNERABLE=1
fi

# Affected: 19.1.0 - 19.1.5
if [ "$MAJOR" -eq 19 ] && [ "$MINOR" -eq 1 ] && [ "$PATCH" -lt 6 ]; then
  VULNERABLE=1
fi

# Affected: 19.2.0 - 19.2.3
if [ "$MAJOR" -eq 19 ] && [ "$MINOR" -eq 2 ] && [ "$PATCH" -lt 4 ]; then
  VULNERABLE=1
fi

if [ "$VULNERABLE" -eq 1 ]; then
  echo "VULNERABLE — GitLab $VERSION is affected by CVE-2026-19650"
  echo "Upgrade to 18.11.11, 19.0.8, 19.1.6, or 19.2.4"
  exit 1
else
  echo "PATCHED — GitLab $VERSION is not affected by CVE-2026-19650"
  exit 0
fi

Sources

1. GitLab Critical Patch Release 19.2.4, 19.1.6, 19.0.8, 18.11.11
2. The Hacker News — Critical GitLab GraphQL Flaw Coverage
3. Tenable — CVE-2026-19650
4. CyberPress — GitLab Critical Vulnerability Analysis
5. GitLab Issue #324397 — CSRF on /api/graphql via GET Mutations
6. CSA Singapore — Multiple Vulnerabilities in GitLab Products
7. GitLab Forum — Critical Patch Release Announcement