Overview
GitLab has patched a maximum-severity path traversal vulnerability in its repository commits API. Tracked as CVE-2026-85706, the flaw allows an unauthenticated attacker to read arbitrary files from a GitLab server under certain conditions, and was assigned a CVSS score of 10.0.
The vulnerability was discovered by security researcher s3ntago and reported through GitLab's HackerOne bug bounty program. It affects self-managed GitLab Community Edition (CE) and Enterprise Edition (EE) installations. Researchers observed active exploitation attempts beginning just one day after public disclosure, and CISA has added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) catalog.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-85706 |
| Severity | Critical (CVSS 10.0) |
| Attack Vector | Network |
| Authentication | None Required |
| Impact | Arbitrary file read from the GitLab server |
| CISA KEV | Yes — active exploitation confirmed |
How It Works
The root cause is improper path confinement combined with missing authentication enforcement in GitLab's repository commits API endpoint. An attacker with no credentials can send a specially crafted request to the commits API and have the application return the contents of files it should never expose — including server-side configuration, secrets, access tokens, SSH keys, and other sensitive data accessible to the GitLab service account.
Exploitation requires only a single HTTP request, which is a major factor in how quickly it was weaponized: WatchTowr reported the first in-the-wild exploitation attempts the day after disclosure, and researchers observed internet-wide probing for vulnerable GitLab instances beginning September 11, 2026.
Affected Versions
- GitLab CE/EE 18.7 through 19.1.7
- GitLab CE/EE 19.2 through 19.2.5
- GitLab CE/EE 19.3 through 19.3.1
GitLab released fixes in 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026.
Related Fix in the Same Advisory
GitLab also patched a second critical flaw, CVE-2026-87719, an insecure deserialization weakness in the GraphQL subscription serializer affecting GitLab EE. That issue allows authenticated users with Duo Chat access to steal sensitive credentials and Advanced Search instance configuration — organizations should apply the same patch release to remediate both issues.
Impact Assessment
Who Is At Risk
Any self-managed GitLab CE or EE instance on an affected version with network-reachable API access is at risk. GitLab.com (the SaaS offering) is not affected by self-managed patch timelines but self-hosted instances — common in enterprises, government, and regulated industries that require on-premises source control — are the primary exposure surface.
Potential Attack Chains
- Reconnaissance — Attacker identifies a GitLab CE/EE instance and its version
- Single-Request Exploitation — A crafted request to the commits API reads arbitrary files off the host
- Credential Harvesting — Configuration files, database credentials, SSH keys, or CI/CD secrets accessible to the GitLab service account are exfiltrated
- Lateral Movement / Supply Chain Impact — Harvested credentials or tokens are used to pivot into connected systems, CI/CD runners, or downstream repositories
Historical Context
This is not GitLab's first appearance in the KEV catalog. Since November 2021, CISA has flagged four GitLab vulnerabilities as actively exploited, including CVE-2021-22175 and CVE-2021-39935.
Mitigation
Immediate Actions
- Patch immediately to GitLab 19.3.2, 19.2.6, or 19.1.8 — treat this as an emergency change given confirmed active exploitation
- Where immediate patching isn't possible, restrict API access to trusted networks only as a stopgap
- Rotate credentials, tokens, and SSH keys accessible to the GitLab service account if compromise is suspected
- Review GitLab access and audit logs for anomalous requests to the commits API, particularly from unauthenticated or unfamiliar sources
Federal Guidance
Per CISA's Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies must remediate KEV-listed vulnerabilities by the assigned deadline or discontinue use of the affected product.