renzi25031469/cve-2026-19478Detects CVE-2026-19478 in GitLab CE/EE with a non-destructive Nuclei template that triggers the GraphQL fallback-field method invocation via touch and confirms vulnerable instances without destructive calls.
-b91c1c?style=flat-square){kind=icon}
Non-destructive Nuclei detection template for CVE-2026-19478, a critical (CVSS 9.4) unauthenticated arbitrary method invocation flaw in the GitLab GraphQL API, patched by GitLab on August 17, 2026.
GitLab's GraphQL schema supports a @gl_introduced(version: "X.Y.Z") directive that gates a field to a minimum GitLab version. When the directive references a version than the running instance, GitLab generates a for the (otherwise unknown) field name. That fallback resolver calls directly on the underlying Ruby object — , , and friends — .
object.public_send(method_name)ProjectUserThe result: an unauthenticated attacker who can reach /api/graphql and knows the fullPath of any public project (or the username of any public profile) can invoke any public, zero-argument method on that object. That includes read-only ones like touch, but also destructive ones like destroy / delete, and state-mutating ones like deactivate / block / ban.
This repo's template only ever calls touch (updates updated_at, returns true) — see Safety below.
| Track | Affected | Fixed |
|---|---|---|
| 18.2.x – 18.11.x | >= 18.2, < 18.11.11 | 18.11.11 |
| 19.0.x | < 19.0.8 | 19.0.8 |
| 19.1.x | < 19.1.6 | 19.1.6 |
| 19.2.x | < 19.2.4 | 19.2.4 |
Self-managed GitLab CE/EE only — GitLab.com and GitLab Dedicated were not affected.
This template is intentionally defanged for scanning fleets of servers you're authorized to test:
touch through the fallback field (an ActiveRecord method that just bumps updated_at and returns true).destroy, delete, deactivate, block, or ban — all of which are reachable through the same bug and are genuinely destructive.root user profile. If neither is reachable it simply reports "not detected" rather than guessing.Do not repurpose the GraphQL query in this template to call mutating methods against systems you do not own or do not have explicit written authorization to test.
| Step | Request | Purpose |
|---|---|---|
| 1 | GET /api/v4/projects?visibility=public | Find a public project to use as a harmless target |
| 2 | POST /api/graphql — touch @gl_introduced(version: "999.0.0") on that project | Trigger the fallback-field resolver; a vulnerable instance returns "touch": true |
| 3 (fallback) | POST /api/graphql — same query against user(username: "root") | Used only if no public project was found in step 1 |
A patched instance rejects the unknown field outright ("... doesn't exist on type ..."), so the template's matcher requires the positive touch signal and the absence of that rejection message.
# single target
nuclei -t CVE-2026-19478.yaml -u https://gitlab.example.com
# validate the template itself
nuclei -t CVE-2026-19478.yaml -validate
# a list of targets, JSON output
nuclei -t CVE-2026-19478.yaml -l targets.txt -j -o results.json
Requires nuclei v3 (this template uses the http: protocol block and a jq-style json extractor introduced in the v3 template engine; it will not load on nuclei v2.x).
[CVE-2026-19478] [http] [critical] https://gitlab.example.com/api/graphql
Upgrade to 18.11.11, 19.0.8, 19.1.6, or 19.2.4 (or later). See GitLab's 19.2.4 patch release notes for the full advisory.
This template is published for defensive security purposes — scanning infrastructure you own or are explicitly authorized to test. Running it (or the linked PoC) against systems without authorization is illegal in most jurisdictions. The author assumes no liability for misuse.