Hackers Exploit Maximum Severity Flaw in GitLab
CISA added GitLab path traversal CVE-2026-85706 to KEV after in-the-wild probes; unauthenticated attackers can read arbitrary files.
CVE-2026-85706 is a maximum-severity path traversal flaw in GitLab CE/EE's repository commits API that allows an unauthenticated user to read arbitrary files from the server due to improper path confinement and missing authentication enforcement. It affects versions 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, and was fixed on September 10. Watchtower reported detecting in-the-wild probes for the bug on September 11, and CISA added the CVE to its Known Exploited Vulnerabilities catalog with a September 15 federal patch deadline. Defenders are urged to hunt logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ URIs containing file.path parameters.
- Unauthenticated path traversal in GitLab CE/EE commits API enables arbitrary file read
- Affects 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2; fixed September 10
- Watchtower detected in-the-wild probes on September 11
- CISA KEV addition sets September 15 patch deadline for federal agencies
- Hunt for POST requests to repository commits API containing file.path parameters
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed. Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts. | 10.0 | 12% | KEV PoC ×9 |
| massLikely >1,000,000 aggregate users across hundreds of thousands of self-managed CE/EE deployments, with tens of thousands of instances directly exposed to the… |
Full article365 words · extracted from infosecurity-magazine.com · click to collapse
GitLab users are being urged to patch a maximum severity vulnerability in the platform after reports of “in-the-wild” exploitation.
CVE-2026-85706 is described as an “improper limitation of a pathname to a restricted directory,” or “path traversal” flaw.
The DevSecOps orchestration platform fixed the issue on September 10.
“GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API,” a security advisory noted.
Read more on GitLab threats: Proxyjacking and Cryptomining Campaign Targets GitLab.
Although GitLab itself hasn’t flagged the vulnerability as being exploited, others have.
Cybersecurity vendor watchtower said on September 11 that it had already detected “in-the-wild probes” for the critical bug.
“Based on recent GitLab vulnerabilities, we know the time until indiscriminate exploitation is likely not far away,” it added.
“Organizations with public-facing self-hosted GitLab instances should patch as soon as possible or remove public access.”
The vendor urged customers to identify potential exploitation attempts by hunting through log files for HTTP POST requests to "/api/v4/projects/{id}/repository/commits/" URIs containing "file.path" parameters.
Another Entry on the CISA Kev Catalog
On the same day, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) Catalog.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” it said.
Only civilian federal agencies are mandated to fix KEV vulnerabilities, in this case with a deadline of September 15. However, it’s also considered best practice for private sector organizations.
“Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable,” CISA recommended.
Security experts have warned that AI tools are helping would-be hackers weaponize new vulnerabilities much quicker than before, while also enabling them to find novel flaws more easily.
Back in May, Google Threat Intelligence Group (GTIG) claimed a first when it revealed how threat actors had been using AI to identify and exploit a zero-day vulnerability.
Image credit: Samuel Boivin / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/hackers-exploit-maximum-severity/