CVE-2026-19650

title: GitLab GraphQL GET Multiplex Request Context
id: 2a18f6f1-2fa4-4a39-a7f0-194780000001
status: experimental
description: >-
  Detects the observed GraphQL multiplex GET request shape and introduced
  directive indicator. The same shape is present in the patched control and
  is therefore contextual rather than a validated standalone detector.
logsource:
  category: webserver
  product: gitlab
detection:
  selection:
    method: GET
    path: /api/graphql
    url|contains|all:
      - /api/graphql
      - _json%5B%5D%5Bquery%5D
      - '%40gl_introduced'
  condition: selection
falsepositives:
  - Authorized local lab reproduction
  - Legitimate GraphQL multiplex GET traffic on patched GitLab versions
level: high
references:
  - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/
  - https://www.cve.org/CVERecord?id=CVE-2026-19650
fields:
  - method
  - path
  - url
note: >-
  Raw URL visibility is required for the encoded multiplex and introduced
  indicator. The normalized fixture mapping is http.method -> method and
  http.path -> path; url remains a collector-specific request-shape field.
cve_mapping:
  cve: CVE-2026-19650
  validation_status: experimental
  vulnerable_dataset: labs/gitlab/CVE-2026-19650/telemetry/vulnerable/events.jsonl
  patched_dataset: labs/gitlab/CVE-2026-19650/telemetry/patched/events.jsonl

View on GitHub

title: GitLab GraphQL GET With Database Write
id: 2a18f6f1-2fa4-4a39-a7f0-194780000002
status: test
description: >-
  Detects a GET GraphQL request with a positive database write count. This is
  validated against the CVE-2026-19650 normalized vulnerable and patched
  fixtures.
logsource:
  category: application
  product: gitlab
detection:
  selection:
    method: GET
    path: /api/graphql
  write:
    db_write_count|gt: 0
  condition: selection and write
falsepositives:
  - Product-specific GraphQL resolvers that legitimately write
  - Authorized administrative or integration workflows that use GET-side effects
level: medium
references:
  - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/
  - https://www.cve.org/CVERecord?id=CVE-2026-19650
fields:
  - method
  - path
  - db_write_count
cve_mapping:
  cve: CVE-2026-19650
  validation_status: lab-validated
  vulnerable_dataset: labs/gitlab/CVE-2026-19650/telemetry/vulnerable/events.jsonl
  patched_dataset: labs/gitlab/CVE-2026-19650/telemetry/patched/events.jsonl
note: Correlate with used_fields and application state; HTTP 200 is not proof.

View on GitHub

title: GitLab GraphQL GET With Issues Create Gate
id: 2a18f6f1-2fa4-4a39-a7f0-194780000003
status: test
description: >-
  Detects a GET GraphQL request associated with the issues_create
  rate-limiting gate. The gate is a supporting application signal and should
  be correlated with database writes and resulting state.
logsource:
  category: application
  product: gitlab
detection:
  selection:
    method: GET
    path: /api/graphql
  gate:
    rate_limiting_gates|contains: issues_create
  condition: selection and gate
falsepositives:
  - Legitimate application behavior or version-specific rate-limit telemetry
  - Authorized issue creation workflows with the same gate name
level: medium
references:
  - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/
  - https://www.cve.org/CVERecord?id=CVE-2026-19650
fields:
  - method
  - path
  - rate_limiting_gates
cve_mapping:
  cve: CVE-2026-19650
  validation_status: lab-validated
  vulnerable_dataset: labs/gitlab/CVE-2026-19650/telemetry/vulnerable/events.jsonl
  patched_dataset: labs/gitlab/CVE-2026-19650/telemetry/patched/events.jsonl

View on GitHub

/*
  Analytic: GitLab GraphQL GET With Database Write
  CVE: CVE-2026-19650
  Expected fields: method, path, db_write_count
  Normalized mapping: http.method -> method; http.path -> path;
  database.db_write_count -> db_write_count
  False positives: legitimate GET-side effects or custom GitLab extensions.
  Lab fixture result: vulnerable match, patched no match, benign no match.
*/
method="GET" path="/api/graphql" db_write_count > 0

View on GitHub

/*
  Analytic: GitLab GraphQL GET With Issues Create Gate
  CVE: CVE-2026-19650
  Expected fields: method, path, rate_limiting_gates
  Normalized mapping: http.method -> method; http.path -> path;
  gitlab.rate_limiting_gates -> rate_limiting_gates
  False positives: legitimate issue workflows or version-specific gate names.
  Lab fixture result: vulnerable match, patched no match, benign no match.
*/
method="GET" path="/api/graphql" rate_limiting_gates="*issues_create*"

View on GitHub

{
  "name": "GitLab GraphQL GET With Database Write",
  "cve": "CVE-2026-19650",
  "type": "query",
  "language": "kuery",
  "query": "http.method: GET and http.path: \"/api/graphql\" and database.db_write_count > 0",
  "severity": "medium",
  "risk_rationale": "A GET GraphQL request with a positive application database write count is a state-change signal in the lab fixtures.",
  "false_positive_note": "Legitimate GET-side effects, custom extensions, or instrumentation may match; correlate with application state and identity.",
  "references": [
    "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/",
    "https://www.cve.org/CVERecord?id=CVE-2026-19650"
  ],
  "fixture_discrimination": {
    "vulnerable": 1,
    "patched": 0,
    "benign": 0
  }
}

View on GitHub

{
  "name": "GitLab GraphQL GET With Issues Create Gate",
  "cve": "CVE-2026-19650",
  "type": "query",
  "language": "kuery",
  "query": "http.method: GET and http.path: \"/api/graphql\" and gitlab.rate_limiting_gates: \"issues_create\"",
  "severity": "medium",
  "risk_rationale": "The issues_create gate is a supporting application signal that can be correlated with a GET GraphQL state change.",
  "false_positive_note": "Legitimate issue workflows and version-specific rate-limit telemetry may produce the same gate.",
  "references": [
    "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/",
    "https://www.cve.org/CVERecord?id=CVE-2026-19650"
  ],
  "fixture_discrimination": {
    "vulnerable": 1,
    "patched": 0,
    "benign": 0
  }
}

View on GitHub

-- Supporting host context; this does not detect the GraphQL behavior.
SELECT name, pid, cmdline, path
FROM processes
WHERE cmdline LIKE '%gitlab%' OR cmdline LIKE '%puma%';

View on GitHub

-- Supporting exposure context; this does not detect the GraphQL behavior.
SELECT local_address, local_port, remote_address, remote_port, state, pid
FROM process_open_sockets
WHERE local_port = 8929 OR remote_port = 8929;

View on GitHub