GitLab CE/EE: missing CSRF protection lets an unauthenticated attacker run GraphQL mutations as a logged-in user

Impact

The CSRF protection on the GraphQL endpoint is incomplete. An unauthenticated attacker who gets a logged-in GitLab user to load attacker-controlled content can run GraphQL mutations with that user's permissions. The record does not limit which mutations are reachable. In a GPU shop the self-hosted GitLab holds pipeline definitions, CI variables and runner registration, so a mutation fired from a maintainer's or admin's session could change what runs on build and GPU CI nodes. GitLab scores it high on confidentiality and integrity.

Who can reach it

A remote attacker with no GitLab account, who needs a victim with an active GitLab session to interact with attacker-controlled content (UI:R). The attacker gets whatever permissions the victim has.

What to do

Upgrade GitLab to 18.9.6, 18.10.4 or 18.11.1, depending on your branch. All versions from 17.0 are affected. This is an application upgrade and service restart on the GitLab host, with no fleet maintenance window. Until it is patched, admins and maintainers should not browse untrusted sites while logged in to GitLab.

References

Related entries

• Airflow Google provider: GCS object names with .. segments write outside the destination pathCVE-2026-49297 · Apache Airflow Google provider (GCSToSFTPOperator, GCSTimeSpanFileTransformOperator path handling)High
• OpenStack glance_store: VMware datastore driver sends authentication headers to an attacker-supplied image location hostCVE-2026-51773 · OpenStack glance_store (VMware datastore driver, _retry_request)High
• Ceph RGW: unsigned x-amz-* headers on presigned URLs are honored, letting a URL holder escalate privilegesCVE-2026-54330 · Ceph Object Gateway (RGW SigV4 presigned-URL header validation)High
• Apache Airflow Git provider: SSH host-key verification disabled by default when cloning DAG bundlesCVE-2026-58065 · Apache Airflow Git provider (apache-airflow-providers-git, git-over-SSH host key checking)High
• GitLab CE/EE: improper path validation lets an unauthenticated attacker run JavaScript in a user's sessionCVE-2026-5816 · GitLab CE/EE (path validation, stored/reflected script execution)High
• Apache Airflow FAB provider: a DAG named 'DAGs' collides with the global all-DAGs permission and escalates privilegesCVE-2026-59245 · Apache Airflow FAB auth manager (apache-airflow-providers-fab, resource_name collision)High