## https://sploitus.com/exploit?id=34EBC1C3-C9A5-54B4-960E-1852818021A0
# CVE-2026-19478 — Nuclei Template
Non-destructive [Nuclei](https://github.com/projectdiscovery/nuclei) detection template for **CVE-2026-19478**, a critical (CVSS 9.4) unauthenticated arbitrary method invocation flaw in the GitLab GraphQL API, patched by GitLab on **August 17, 2026**.
## TL;DR
GitLab's GraphQL schema supports a `@gl_introduced(version: "X.Y.Z")` directive that gates a field to a minimum GitLab version. When the directive references a version *newer* than the running instance, GitLab generates a **fallback field** for the (otherwise unknown) field name. That fallback resolver calls `object.public_send(method_name)` directly on the underlying Ruby object — `Project`, `User`, and friends — **without re-checking authorization**.
The result: an unauthenticated attacker who can reach `/api/graphql` and knows the `fullPath` of any public project (or the username of any public profile) can invoke *any public, zero-argument method* on that object. That includes read-only ones like `touch`, but also destructive ones like `destroy` / `delete`, and state-mutating ones like `deactivate` / `block` / `ban`.
This repo's template only ever calls `touch` (updates `updated_at`, returns `true`) — see [Safety](#safety) below.
## Affected versions
| Track | Affected | Fixed |
|---|---|---|
| 18.2.x – 18.11.x | `>= 18.2, < 18.11.11` | `18.11.11` |
| 19.0.x | `< 19.0.8` | `19.0.8` |
| 19.1.x | `< 19.1.6` | `19.1.6` |
| 19.2.x | `< 19.2.4` | `19.2.4` |
Self-managed GitLab CE/EE only — GitLab.com and GitLab Dedicated were not affected.
## Safety
This template is intentionally defanged for scanning fleets of servers you're authorized to test:
- It only ever invokes **`touch`** through the fallback field (an `ActiveRecord` method that just bumps `updated_at` and returns `true`).
- It **never** calls `destroy`, `delete`, `deactivate`, `block`, or `ban` — all of which are reachable through the same bug and are genuinely destructive.
- Detection is opportunistic: it enumerates one public project via the REST API and, if none is visible, falls back to probing the default `root` user profile. If neither is reachable it simply reports "not detected" rather than guessing.
Do not repurpose the GraphQL query in this template to call mutating methods against systems you do not own or do not have explicit written authorization to test.
## How detection works
| Step | Request | Purpose |
|---|---|---|
| 1 | `GET /api/v4/projects?visibility=public` | Find a public project to use as a harmless target |
| 2 | `POST /api/graphql` — `touch @gl_introduced(version: "999.0.0")` on that project | Trigger the fallback-field resolver; a vulnerable instance returns `"touch": true` |
| 3 (fallback) | `POST /api/graphql` — same query against `user(username: "root")` | Used only if no public project was found in step 1 |
A patched instance rejects the unknown field outright (`"... doesn't exist on type ..."`), so the template's matcher requires the positive `touch` signal **and** the absence of that rejection message.
## Usage
```bash
# single target
nuclei -t CVE-2026-19478.yaml -u https://gitlab.example.com
# validate the template itself
nuclei -t CVE-2026-19478.yaml -validate
# a list of targets, JSON output
nuclei -t CVE-2026-19478.yaml -l targets.txt -j -o results.json
```
Requires **nuclei v3** (this template uses the `http:` protocol block and a jq-style `json` extractor introduced in the v3 template engine; it will not load on nuclei v2.x).
### Example output
```
[CVE-2026-19478] [http] [critical] https://gitlab.example.com/api/graphql
```
## Remediation
Upgrade to `18.11.11`, `19.0.8`, `19.1.6`, or `19.2.4` (or later). See GitLab's [19.2.4 patch release notes](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/) for the full advisory.
## References
- [GitLab 19.2.4 patch release notes](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/)
- [The Hacker News — Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects](https://thehackernews.com/2026/08/critical-gitlab-graphql-flaw-could-let.html)
- [Rescana — CVE-2026-19478 technical writeup](https://www.rescana.com/post/cve-2026-19478-critical-gitlab-ce-ee-graphql-vulnerability-enables-remote-deletion-of-public-projects-and-user-data)
- [PoC (davkharrr/CVE-2026-19478-PoC)](https://github.com/davkharrr/CVE-2026-19478-PoC)
## Disclaimer
This template is published for defensive security purposes — scanning infrastructure you own or are explicitly authorized to test. Running it (or the linked PoC) against systems without authorization is illegal in most jurisdictions. The author assumes no liability for misuse.
## License
[MIT](./LICENSE)