Maximum-Severity Flaw, Same-Day Probing
GitLab shipped patches for 18 security flaws on September 10, 2026, in versions 19.3.2, 19.2.6, and 19.1.8 — but one of them stood out immediately: CVE-2026-85706, a maximum-severity CVSS 10.0 path-traversal bug in the repository commits API. Researchers at watchTowr observed active in-the-wild probing of the flaw starting at 06:00 UTC on September 11, just hours after public disclosure.
CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) catalog the same day, setting a federal remediation deadline of September 14, 2026 under Binding Operational Directive 22-01.
What's Broken
CVE-2026-85706 stems from improper path confinement combined with missing authentication enforcement in GitLab's repository commits API. The combination lets an unauthenticated attacker read arbitrary files on the server — including logs and configuration files that may contain credentials and secrets.
| CVE | CVSS | Description |
|---|---|---|
| CVE-2026-85706 | 10.0 | Unauthenticated path traversal in the repository commits API — arbitrary file read |
| CVE-2026-87719 | 9.9 | Insecure deserialization in the GraphQL subscription serializer (Enterprise Edition only, requires authenticated Duo Chat access) |
| CVE-2026-88765 | Not individually scored in coverage | Buffer overflow in EE's Unicode conversion wrapper, used by Advanced Search indexing |
The flaw was reported through GitLab's HackerOne bug bounty program by researcher "s3ntago."
Affected Versions
CVE-2026-85706 affects GitLab Community Edition and Enterprise Edition from 18.7 up to 19.1.7, all 19.2.x releases before 19.2.6, and 19.3.0–19.3.1. GitLab.com and GitLab Dedicated are already patched on GitLab's side; self-managed instances need to upgrade to 19.3.2, 19.2.6, or 19.1.8 — a single upgrade addresses both CVE-2026-85706 and the companion CVE-2026-87719.
The In-the-Wild Activity
watchTowr researcher Jake Knott noted that exploitation has one precondition: "at least one public project must exist" on the target instance. Knott warned that the transition "to indiscriminate mass exploitation is likely not far away," given how quickly probing began after disclosure — a pattern that has become increasingly common for high-severity GitLab and DevOps-tooling CVEs, where public exploit details or patch diffs let attackers reverse-engineer a working exploit within hours.
Remediation
- Upgrade self-managed GitLab instances to 19.3.2, 19.2.6, or 19.1.8 immediately — federal agencies face a September 14, 2026 deadline under CISA's KEV listing, and the same urgency applies to any organization running a public-facing GitLab instance
- Audit logs for repository-commits-API access patterns consistent with path-traversal attempts, particularly requests referencing paths outside expected project directories
- Rotate credentials and secrets that may be reachable via arbitrary file read on any instance that wasn't patched promptly, including CI/CD variables,
.env-style config, and log files - Confirm GitLab.com/Dedicated tenancy is unaffected, but don't assume self-managed instances inherited the fix automatically — this requires an explicit version upgrade
Why It Matters
A CVSS 10.0 unauthenticated file-read bug in a platform that routinely stores CI/CD secrets, deployment credentials, and source code is about as high-value a target as attackers get — and the same-day probing shows the window between disclosure and mass exploitation continuing to shrink. Any organization running self-managed GitLab should treat this as a patch-now item rather than something to schedule into a routine maintenance window.