A critical GitLab vulnerability is being actively exploited shortly after its public disclosure. The flaw carries a maximum CVSS score of 10.0. Tracked as CVE-2026-85706, the vulnerability affects GitLab's repository commits API. It can allow unauthenticated attackers to read arbitrary files from vulnerable GitLab servers.
GitLab disclosed the vulnerability on September 10, 2026. Security researchers observed exploitation attempts within hours of its disclosure. The U.S. Cybersecurity and Infrastructure Security Agency added GitLab CVE-2026-85706 to its KEV catalog. Following that, CISA added the vulnerability on September 11.
GitLab CVE-2026-85706 Allows Unauthenticated File Access
GitLab identified improper path confinement and missing authentication enforcement as the root issues. The weaknesses affect the repository commits API. Under certain conditions, an unauthenticated attacker can read arbitrary files from the GitLab server. This makes exposed self-managed installations particularly vulnerable.
The National Vulnerability Database classifies GitLab CVE-2026-85706 as CWE-22, where the weakness involves improper limitation of a pathname to a restricted directory. A successful attack could expose sensitive server information. Potentially accessible data includes credentials, tokens, configuration files, and other secrets.
Researchers also warned about possible exposure to SSH keys and CI/CD variables. Such information could provide attackers with access to connected systems. The exploitation activity began around 06:00 UTC on September 11. Hence, it was identified approximately one day after GitLab disclosed the vulnerability.
Researchers said exploitation requires at least one public project on the affected GitLab instance. Attackers can then target vulnerable repository API functionality.
CISA Confirms Active Exploitation
CISA's KEV listing confirms that CVE-2026-85706 is being exploited in real-world attacks. The agency highlighted the vulnerability's path traversal characteristics. CISA also noted that path traversal vulnerabilities are frequently exploited. Organizations are therefore urged to prioritize remediation of affected systems.
Attackers could potentially use exposed credentials to move beyond the vulnerable GitLab server. They could also target software development and deployment pipelines.
GitLab Releases Security Patches
GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10. The releases address GitLab CVE-2026-85706 and several other security issues. Affected versions include GitLab CE and EE versions from 18.7 before 19.1.8. Versions 19.2 before 19.2.6 are also affected.
GitLab 19.3 versions before 19.3.2 are affected as well. GitLab strongly recommends immediate upgrades for affected self-managed installations. GitLab.com is already running a patched version. GitLab Dedicated customers do not need to take action.
The same patch releases address another critical vulnerability, CVE-2026-87719, which affects the GraphQL subscription serializer in GitLab Enterprise Edition. That flaw has a CVSS score of 9.9 and can expose sensitive credentials under certain conditions.
Organizations Should Review Logs
Organizations and security teams should immediately determine whether vulnerable GitLab versions remain exposed to address GitLab CVE-2026-85706. They should also analyze systems that may have received suspicious requests. Reviewing HTTP POST requests targeting the repository commits API can also be beneficial. Requests containing file.path parameters could indicate exploitation attempts.
Organizations should also investigate potentially exposed credentials and secrets. Compromised credentials should be rotated after assessing possible exploitation. The quick exploitation of GitLab CVE-2026-85706 highlights the risks facing internet-facing development platforms. Organizations should prioritize patching rather than wait for widespread exploitation.
Visit WisdomPlexus and discover which cybersecurity threats and practices are taking the center stage.
Recommended For You:
7 Best Cybersecurity Tools to Protect Your Organization’s Data
