On September 10, 2026, GitLab disclosed CVE-2026-85706, a maximum-severity path traversal vulnerability in its repository commits API. The flaw carries a CVSS score of 10.0 and allows unauthenticated attackers to read arbitrary files from vulnerable GitLab servers under certain conditions. Consequently, threat actors began scanning for exposed instances within hours of disclosure.
What Happened: GitLab CVSS 10.0 Path Traversal Flaw Draws In-the-Wild Probes
GitLab released security patches for Community Edition (CE) and Enterprise Edition (EE) on September 10, 2026, to address multiple flaws. The most critical is CVE-2026-85706, a path traversal issue in the repository commits API. Moreover, security researchers discovered the vulnerability stems from improper path confinement and missing authentication enforcement.
The flaw allows an unauthenticated attacker to read arbitrary files from a GitLab server if at least one public project exists. In addition, cybersecurity firm watchTowr confirmed active in-the-wild probing began at 06:00 UTC on September 11, 2026. Attackers are using single HTTP requests to extract log files, configuration files, credentials, and secrets.
Technical Details of the GitLab Path Traversal Vulnerability
CVE-2026-85706 resides in the repository commits API endpoint. Because of improper path confinement, an attacker can traverse outside the intended directory and access sensitive server files. Furthermore, the missing authentication enforcement means no valid credentials are required.
The attack requires just one condition: at least one public project must exist on the target GitLab instance. For example, an attacker can send a crafted HTTP POST request to /api/v4/projects/{id}/repository/commits/ with a manipulated file.path parameter. Thus, the attacker can read arbitrary files such as /etc/passwd, log files, or GitLab configuration files containing secrets.
Also patched in the same release is CVE-2026-87719 (CVSS 9.9), an insecure deserialization bug in GitLab EE. This flaw allows authenticated users with Duo Chat access to steal Advanced Search instance configurations and sensitive credentials via a crafted GraphQL subscription argument.
Business and Operational Impact
GitLab is a core DevSecOps platform used by over 30 million registered users and more than 50% of Fortune 100 companies. Therefore, successful exploitation of CVE-2026-85706 can have severe consequences:
- Source code exposure: Attackers can read proprietary source code and intellectual property.
- Credential theft: Configuration files often contain CI/CD secrets, API tokens, and database credentials.
- Supply chain risk: Compromised build pipelines can lead to code injection and downstream poisoning.
- Reputational damage: Public disclosure of internal projects and secrets erodes customer trust.
- Compliance violations: Data breaches may trigger regulatory reporting requirements under GDPR, PCI-DSS, or SOC 2.
Mitigation and Recommendations
Organizations running self-managed GitLab instances should act immediately to reduce exposure. Furthermore, defenders should monitor logs for exploitation attempts.
Immediate Actions for Defenders
- Patch immediately: Upgrade to GitLab CE/EE versions 19.3.2, 19.2.6, or 19.1.8.
- Limit public exposure: Restrict internet-facing GitLab instances to trusted IP ranges or VPN access.
- Review public projects: Remove or privatize unnecessary public projects to reduce attack surface.
- Hunt in logs: Search for HTTP POST requests to
/api/v4/projects/{id}/repository/commits/containingfile.pathparameters. - Rotate secrets: If exploitation is suspected, rotate CI/CD secrets, API tokens, and database credentials.
Long-Term Hardening
In addition to patching, organizations should review their GitLab instance configurations regularly. Also, enable audit logging and integrate logs with a SIEM for anomaly detection. Finally, conduct periodic vulnerability scans of self-hosted DevOps tools.
Bottom line: CVE-2026-85706 is a maximum-severity, unauthenticated path traversal flaw with confirmed in-the-wild exploitation. Patching is urgent, and organizations should assume scanning is already underway.
Incident Summary
| CVE ID / Incident: | CVE-2026-85706 |
| Affected Systems: | GitLab CE/EE versions 18.7–19.1.8, 19.2–19.2.6, 19.3–19.3.2 |
| Disclosure Date: | September 10, 2026 |
| Patch Status: | Available — upgrade to 19.3.2, 19.2.6, or 19.1.8 |
| CVSS Score: | 10.0 (Critical) |
| Exploitation Status: | Active in-the-wild probes confirmed by watchTowr |
References
- GitLab Inc., “Patch release: GitLab 19.3.2, 19.2.6, and 19.1.8,” September 10, 2026. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/
- watchTowr, LinkedIn post on CVE-2026-85706 in-the-wild activity, September 11, 2026. https://www.linkedin.com/posts/watchtowr_watchtowr-intel-is-already-observing-in-the-wild-activity-7504127032608415744-8JqE/
- The Hacker News, “GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure,” September 11, 2026. https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html
- BleepingComputer, “GitLab urges users to patch max severity path traversal flaw,” September 11, 2026. https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/
