CISA: Hackers now exploit max severity GitLab flaw in attacks
CISA added max-severity GitLab CVE-2026-85706 to its exploited-flaws catalog after watchTowr observed probing of unpatched servers.
CISA added CVE-2026-85706, a maximum-severity GitLab flaw caused by missing authentication enforcement and improper path confinement in the repository commits API, to its actively exploited vulnerabilities catalog. Unauthenticated attackers can read credentials, secrets, and arbitrary files from vulnerable servers via a single HTTP request. GitLab patched the issue in CE/EE versions 19.3.2, 19.2.6, and 19.1, and federal agencies have three days to remediate under BOD 26-04. watchTowr reported in-the-wild probes for unpatched GitLab servers, and this is the fourth GitLab vulnerability CISA has tagged as actively exploited since November 2021.
- Unauthenticated attackers can read arbitrary files and secrets via commits API
- Fixed in GitLab CE/EE 19.3.2, 19.2.6, and 19.1
- CISA KEV listing gives federal agencies three days to patch under BOD 26-04
- watchTowr observed internet-wide probes for unpatched GitLab servers
- Hunt for POST requests to /api/v4/projects/{id}/repository/commits/ with file.path parameters
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-22175 | Unauthenticated SSRF in GitLab via Internal-Network Webhook Requests (CVE-2021-22175) | 9.8 | 53% | KEVPoC | KEV |
| CVE-2021-39935 | Server-Side Request Forgery in GitLab Community and Enterprise Editions via CI Lint API | 7.5 | 36% | KEV | KEV |
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
From the original article
2 min read at bleepingcomputer.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are now exploiting a maximum-severity GitLab vulnerability in attacks.
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.