CVE-2026-85706: GitLab Path Traversal Flaw Hit CVSS 10.0, Added to CISA KEV

Overview

GitLab has patched a maximum-severity path traversal vulnerability in its repository commits API. Tracked as CVE-2026-85706, the flaw allows an unauthenticated attacker to read arbitrary files from a GitLab server under certain conditions, and was assigned a CVSS score of 10.0.

The vulnerability was discovered by security researcher s3ntago and reported through GitLab's HackerOne bug bounty program. It affects self-managed GitLab Community Edition (CE) and Enterprise Edition (EE) installations. Researchers observed active exploitation attempts beginning just one day after public disclosure, and CISA has added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) catalog.

Technical Details

How It Works

The root cause is improper path confinement combined with missing authentication enforcement in GitLab's repository commits API endpoint. An attacker with no credentials can send a specially crafted request to the commits API and have the application return the contents of files it should never expose — including server-side configuration, secrets, access tokens, SSH keys, and other sensitive data accessible to the GitLab service account.

Exploitation requires only a single HTTP request, which is a major factor in how quickly it was weaponized: WatchTowr reported the first in-the-wild exploitation attempts the day after disclosure, and researchers observed internet-wide probing for vulnerable GitLab instances beginning September 11, 2026.

Affected Versions

• GitLab CE/EE 18.7 through 19.1.7
• GitLab CE/EE 19.2 through 19.2.5
• GitLab CE/EE 19.3 through 19.3.1

GitLab released fixes in 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026.

Related Fix in the Same Advisory

GitLab also patched a second critical flaw, CVE-2026-87719, an insecure deserialization weakness in the GraphQL subscription serializer affecting GitLab EE. That issue allows authenticated users with Duo Chat access to steal sensitive credentials and Advanced Search instance configuration — organizations should apply the same patch release to remediate both issues.

Impact Assessment

Who Is At Risk

Any self-managed GitLab CE or EE instance on an affected version with network-reachable API access is at risk. GitLab.com (the SaaS offering) is not affected by self-managed patch timelines but self-hosted instances — common in enterprises, government, and regulated industries that require on-premises source control — are the primary exposure surface.

Potential Attack Chains

1. Reconnaissance — Attacker identifies a GitLab CE/EE instance and its version
2. Single-Request Exploitation — A crafted request to the commits API reads arbitrary files off the host
3. Credential Harvesting — Configuration files, database credentials, SSH keys, or CI/CD secrets accessible to the GitLab service account are exfiltrated
4. Lateral Movement / Supply Chain Impact — Harvested credentials or tokens are used to pivot into connected systems, CI/CD runners, or downstream repositories

Historical Context

This is not GitLab's first appearance in the KEV catalog. Since November 2021, CISA has flagged four GitLab vulnerabilities as actively exploited, including CVE-2021-22175 and CVE-2021-39935.

Mitigation

Immediate Actions

• Patch immediately to GitLab 19.3.2, 19.2.6, or 19.1.8 — treat this as an emergency change given confirmed active exploitation
• Where immediate patching isn't possible, restrict API access to trusted networks only as a stopgap
• Rotate credentials, tokens, and SSH keys accessible to the GitLab service account if compromise is suspected
• Review GitLab access and audit logs for anomalous requests to the commits API, particularly from unauthenticated or unfamiliar sources

Federal Guidance

Per CISA's Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies must remediate KEV-listed vulnerabilities by the assigned deadline or discontinue use of the affected product.

References

• The Hacker News — GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes
• BleepingComputer — GitLab urges users to patch max severity path traversal flaw
• watchTowr — Rapid Reaction: GitLab Path Traversal Vulnerability
• CISA — Known Exploited Vulnerabilities Catalog