Affected Systems
GitLab Community Edition (CE) and Enterprise Edition (EE): versions 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. Affects self-hosted instances with publicly accessible projects.
Exploitation Status
Active exploitation confirmed. watchTowr observed in-the-wild attacks against honeypot infrastructure within days of disclosure. Vulnerability reproducible within minutes using AI-assisted methods.
Business Impact
Unauthenticated attackers can modify or delete public GitLab projects via GraphQL directive exploitation (CVSS 9.4). No credentials, user interaction, or special configuration required. Attackers can delete entire repositories, forge merge records to hide missing fixes, and ban project maintainers. Particularly critical for organizations running internet-facing self-hosted GitLab instances with public repositories. Supply chain risk: forged merge records could mask missing security patches.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade GitLab CE/EE to patched versions: 19.2.4, 19.1.6, 19.0.8, or 18.11.11
- Hunt through web server logs for requests containing '@gl_introduced' to detect exploitation attempts or successful attacks
- If immediate patching is not feasible, restrict unauthenticated access to '/api/graphql' endpoint or disable public repository access entirely
- Review recent project modifications, deletions, merge records, and user bans for signs of tampering, especially in public repositories
- Prioritize patching for all internet-facing self-hosted GitLab instances before addressing internal-only deployments