When GraphQL Directives Become Weapons: The Unauthenticated Project Deletion Path

The core of CVE-2026-19478 lies in how GitLab's GraphQL engine handles custom directives. GitLab uses the graphql-ruby gem, which supports custom directives defined in the schema. One such directive, likely named something like '@deleteProject' or '@modifyObject', was intended to be used only by authenticated internal services. But it was registered in the schema under a scope that introspection queries could reach. An attacker sends a POST to '/api/graphql' with a body that looks like this: ```graphql mutation { __schema { types { name fields { name args { name type { name } } } } } @deleteProject(namespace: "victim

The order of these steps matters. Doing them in the wrong sequence creates a false sense of safety. Step 1: Disable GraphQL introspection on all self-managed GitLab instances. The setting is in gitlab.rb: 'gitlab_rails['graphql_disable_introspection'] = true'. Do this before anything else. It blocks the most common reconnaissance path attackers use before exploiting directive-based flaws. Most teams skip this because they want GraphiQL to work for developers. Create a separate QA instance with introspection enabled for that purpose. Step 2: Subscribe to GitLab's patch release RSS feed and integrate it into your ticketing system. Do not rely on your vulnerability scanner alone. Set up a webhook or a cron job that checks 'https://about.gitlab.com/releases/categories/releases/atom.xml' daily. When a new patch release arrives, your system should create a ticket automatically. Step 3: Apply the patch within 72 hours for any critical-severity CVE. For self-managed instances, this means having a deployment pipeline that can bypass the usual change management window. Pre-authorize a "critical patch" deployment path that only requires a sign-off from the lead DevOps engineer, not the full change advisory board. Step 4: Audit your GitLab configuration for any GraphQL directives that are registered in the schema but are not behind authentication guards. You can do this by running 'gitlab-rails console' and enumerating all custom directives with 'GraphQL::Schema.directives'. Remove any that are not explicitly needed. Step 5: For environments that cannot patch immediately, add a WAF rule that blocks POST requests to '/api/graphql' that contain the string '@' followed by a directive name. This is a crude filter, but it buys time. It will break some legitimate GraphQL features, so test before enabling.

If you suspect exploitation, the first 24 hours are critical. The CISO's job is to authorize the emergency patch deployment and to notify the compliance officer if the instance contains customer data. No need for legal yet. The IR team should pull the GitLab access logs for '/api/graphql' and look for requests that contain directive-like patterns. Most deployments log at 'info' level, which will show the raw GraphQL query. Script a grep for '@deleteProject', '@modifyObject', or any directive that is not standard. The DevOps lead needs to patch the instance immediately and then verify by running the same query against the patched version to confirm it fails. A common stall point is the handoff between IR and DevOps. IR finds logs but does not know which directives are dangerous. DevOps knows the schema but is not looking at logs. The fix is a single shared Slack channel where both teams post queries and schema details in the first hour. By 72 hours, legal should be involved if any project data was deleted. GitLab's audit log tracks 'project_destroy' events at the instance level. Exfiltrate those audit logs before the attacker deletes them too. The most commonly missed action: no one checks for backup integrity before restoring. In one Vulnox incident simulation, the team restored a deleted project only to discover the backup itself was three months old. Do not assume backups are usable. Verify them on a schedule.

Three lessons carry beyond this single CVE. First, the attack surface of any API is defined by its middleware chain, not its endpoint listing. The GraphQL directive runs before the authentication middleware. That ordering is invisible to most scanners. Second, partial mitigations are often worse than no mitigation because they create a false sense of coverage. Disabling introspection on one endpoint but leaving it on another is not a strategy. Third, the gap between a patch release and a scanner signature is the most dangerous window in vulnerability management. It is where zero-days live for defenders who rely on automated tools. Closing that gap requires a human decision to patch without a signature.