Loading vulnerability…
CVE-2026-19650 is a high-severity cross-site request forgery vulnerability in GitLab Community Edition and Enterprise Edition. The flaw affects the GraphQL multiplex query handler, where improper request validation can allow GraphQL mutations to be executed via HTTP GET requests under certain conditions. Because mutations are state-changing operations, accepting them through inadequately validated GET requests can break expected CSRF protections and permit unauthorized actions to be triggered in a victim’s browser context. Affected versions include all releases from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A GitLab CSRF vulnerability in the GraphQL multiplex query handler that could allow an unauthenticated user to execute mutations via GET requests due to improper request validation.
A CSRF-related weakness in GitLab GraphQL multiplex query handling that can let an unauthenticated attacker trigger mutations through GET requests due to improper validation.
A high-severity GitLab GraphQL CSRF vulnerability in the multiplex query handler that could allow unauthenticated attackers to execute GraphQL mutations through GET requests when conditions are met; user interaction is required.
A high-severity GitLab GraphQL API vulnerability requiring victim interaction, where a crafted link can enable attackers to alter project settings and potentially compromise entire instances if the victim has admin rights.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.