GitLab patched a CVSS 10.0 file-read flaw, CVE-2026-85706.
Just hours after GitLab issued urgent security patches on September 10, 2026, for a maximum-severity flaw, cybersecurity firms observed active exploitation attempts in the wild. The vulnerability, tracked as CVE-2026-85706, has a critical CVSS score of 10.0, signaling the gravest possible risk. In response to the confirmed active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) quickly added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog on September 11, 2026, demanding that Federal Civilian Executive Branch (FCEB) agencies apply fixes by September 14, 2026, just days after public disclosure and patch availability.
This rapid sequence of events underscores the severe threat posed by CVE-2026-85706. The flaw could allow an unauthenticated attacker to read arbitrary files from affected GitLab servers, potentially exposing highly sensitive data such as credentials, secret keys, and configuration files. Organizations running self-managed GitLab instances are now facing a critical window to implement the necessary updates before falling victim to ongoing attacks.
The vulnerability, identified as CVE-2026-85706, is a path traversal flaw located within GitLab’s repository commits API. Path traversal, also known as directory traversal, allows attackers to access files and directories stored outside the intended root directory of an application. This is typically achieved by manipulating input paths with sequences like ../ (dot-dot-slash) to traverse up directory hierarchies.
In the case of CVE-2026-85706, the root cause stems from a combination of improper path confinement and a critical absence of authentication enforcement. This means the affected API endpoint failed to correctly restrict file access requests to the designated repository path and, alarmingly, allowed these requests to proceed without verifying the user's identity or permissions. The consequence is dire: an unauthenticated attacker can craft malicious requests to bypass intended directory restrictions and read any file accessible by the GitLab server process.
Security researcher 's3ntago' is credited with discovering and reporting this critical flaw through GitLab's HackerOne bug bounty program, providing the initial disclosure that led to GitLab's immediate response. The sole prerequisite for an attacker to exploit this vulnerability is the presence of at least one public project on the GitLab server, a common configuration for many development environments.
The repository commits API in GitLab is designed to handle interactions with code repositories. When a path traversal vulnerability exists, an attacker can manipulate the path parameter in an API request. Instead of requesting a file strictly within a repository's defined structure, they can insert characters like ../../../../etc/passwd to attempt to access system files outside the repository. Because of the missing authentication enforcement, these requests are processed as if they are legitimate, even from an unauthenticated user.
For instance, an attacker could attempt to retrieve sensitive system files such as /etc/passwd to enumerate users, /etc/shadow for hashed passwords, or configuration files for various services running on the server, which often contain API keys, database credentials, or other secrets. Given GitLab's role in software development, the compromise of a GitLab server could yield access to source code, deployment pipelines, and ultimately, production environments, making this flaw particularly dangerous.
GitLab released patches for CVE-2026-85706 on September 10, 2026. The vulnerability impacts various versions of both GitLab Community Edition (CE) and Enterprise Edition (EE). Organizations operating self-managed GitLab instances are especially at risk and must prioritize upgrading their systems immediately. GitLab.com and GitLab Dedicated customers benefit from automatic updates and are already protected.
Specifically, the following versions are affected:
All GitLab CE/EE versions from 18.7 before 19.1.8
All GitLab CE/EE versions from 19.2 before 19.2.6
All GitLab CE/EE versions from 19.3 before 19.3.2
The patched versions that resolve this vulnerability are 19.1.8, 19.2.6, and 19.3.2. Administrators are strongly advised to check their current GitLab version and apply the appropriate update without delay. Given the confirmed in-the-wild exploitation, procrastination could lead to a severe security breach.
Here's a summary of the critical details for system administrators:
URGENT ACTION: All organizations using self-managed GitLab instances within the affected version ranges must initiate an immediate upgrade to the patched versions to mitigate the risk of compromise. Failure to act promptly significantly increases exposure to active attacks.
The transition from vulnerability disclosure to active exploitation was remarkably swift. Cybersecurity firm watchTowr reported observing in-the-wild probes for CVE-2026-85706 starting September 11, 2026, mere hours after GitLab's public disclosure of the patches. This rapid response from threat actors underscores the attractiveness of a maximum-severity, unauthenticated file-read flaw in a widely used development platform.
The observed exploitation attempts quickly prompted the U.S. CISA to take decisive action. On September 11, 2026, CISA officially added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) Catalog. Inclusion in the KEV catalog signifies that the vulnerability is actively being exploited and poses a significant risk to federal information systems. Consequently, FCEB agencies have been mandated to apply the necessary fixes for CVE-2026-85706 by September 14, 2026, setting a tight deadline for compliance and reflecting the urgent nature of the threat.
This government mandate highlights the broader implications beyond just federal networks. Organizations across all sectors should treat the CISA KEV Catalog listing as an unequivocal signal to prioritize patching efforts. Active exploitation means that attackers are scanning the internet for vulnerable systems and attempting to compromise them right now.
While CVE-2026-85706 takes center stage due to its maximum severity and active exploitation, GitLab's September 10, 2026, security update addressed other critical vulnerabilities as well. This emphasizes the importance of applying the comprehensive update rather than selectively patching individual flaws.
The update also patched:
CVE-2026-87719: An insecure deserialization vulnerability with a CVSS score of 9.9. Insecure deserialization flaws can allow attackers to execute arbitrary code or trigger denial-of-service conditions by manipulating serialized objects. This type of vulnerability can be particularly dangerous, often leading to full system compromise.
CVE-2026-88765: A buffer overflow vulnerability rated with a CVSS score of 8.5. Buffer overflows can lead to memory corruption, potentially allowing attackers to execute malicious code or cause system instability. While slightly lower in score than the other two, an 8.5 CVSS still represents a high-severity flaw.
The presence of multiple critical vulnerabilities in a single update underscores the need for a robust patch management strategy. Administrators should ensure their update processes are streamlined to incorporate all critical security fixes, protecting against a broader range of potential attacks.
The immediate exploitation of a maximum-severity, unauthenticated file-read vulnerability in GitLab, coupled with CISA's rapid inclusion in its KEV Catalog, presents a significant and immediate threat to any organization using self-managed GitLab instances. This flaw allows attackers to gain access to sensitive files like credentials and secrets without needing any authentication, essentially providing a backdoor to critical development infrastructure. The window for mitigation is narrow, with observed probes beginning within hours of disclosure and a federal patching deadline set for days later. Failure to promptly upgrade to patched versions could lead to severe data breaches, compromise of entire development pipelines, and substantial operational disruption and financial consequences. The broad implications for federal agencies under CISA's directive highlight the urgency for all organizations to address this vulnerability immediately.
For organizations operating self-managed GitLab instances, the immediate priority is to apply the security updates to versions 19.1.8, 19.2.6, or 19.3.2. This action must be taken with the utmost urgency, ideally before the CISA deadline for federal agencies of September 14, 2026. After patching, administrators should conduct thorough security audits to search for any signs of compromise that might have occurred in the brief window between public disclosure and remediation.
This incident serves as a stark reminder of the relentless nature of cybersecurity threats. The speed with which critical vulnerabilities are weaponized demands that organizations maintain agile and responsive patch management programs. Furthermore, reviewing the security posture of development environments, implementing least privilege principles, and continuously monitoring for suspicious activity are crucial steps to build resilience against similar threats in the future. The cybersecurity community will continue to monitor for the broader impact of CVE-2026-85706 and the other critical GitLab flaws in the coming days and weeks.
