GitLab Patches Critical File-Access Flaw as Internet-Wide Probing Begins
Summary
GitLab patched critical unauthenticated path traversal flaw CVE-2026-85706 in self-managed CE and EE; researchers reported internet-wide probing beginning September 11. Exposed files may include credentials and tokens.
Key points
- GitLab released fixes on September 10, 2026, for CVE-2026-85706, which it rated CVSS 10.0.
- The flaw affects self-managed GitLab CE and EE releases before 19.1.8, 19.2.6, and 19.3.2 in their respective release branches.
- An unauthenticated attacker can exploit the repository commit API to read files accessible to the GitLab service account, potentially with a single HTTP request.
- Accessible files may include application secrets, authentication tokens, SSH keys, database credentials, cloud access keys, and configuration data; exposure depends on deployment and permissions.
- Researchers reported internet-wide probing of vulnerable servers beginning September 11, 2026.
- Upgrade to 19.1.8, 19.2.6, 19.3.2, or a later supported release; review relevant HTTP POST requests and consider rotating credentials that may have been exposed.
Article Details
- Vulnerability Types
- Path traversal
- Unauthenticated arbitrary file access
- Severity
- Critical (CVSS 10.0)
- Affected Versions
- GitLab CE/EE 18.7 before 19.1.8
- GitLab CE/EE 19.2 before 19.2.6
- GitLab CE/EE 19.3 before 19.3.2
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict unnecessary internet access to self-managed GitLab deployments.
MITRE ATT&CK
T1005 · Data from Local SystemSuccessful exploitation can retrieve files from the GitLab server that are readable by the GitLab service account.T1190 · Exploit Public-Facing ApplicationThe vulnerability allows unauthenticated remote requests to exploit a vulnerable GitLab API on self-managed deployments.