Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code

GBHackersby DivyaSep 11, 2026 · 10:13 UTC (Sep 11, 2026)3 min read2 · 1 read

AI summary · glm-5.3-flashSummaries by Vani AI

GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.

Key facts

CVE-2026-85706 (CVSS 10.0) lets unauthenticated attackers read arbitrary files from internet-exposed GitLab servers.
CVE-2026-87719 (CVSS 9.9) exposes credentials via crafted GraphQL subscription arguments in Enterprise Edition.
CVE-2026-88765 (CVSS 8.5) enables potential RCE through malicious project exports triggering a Unicode buffer overflow.
Fixes ship in GitLab 19.3.2, 19.2.6, and 19.1.8; self-managed instances should upgrade immediately.
Additional fixes cover CI/CD variable exposure, XSS, SAML SSO bypasses, and GraphQL denial of service.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-85706 CVE-2026-87719 CVE-2026-88765 CVE-2026-79708 CVE-2026-78252 CVE-2026-13210 CVE-2025-14871 CVE-2026-1168 CVE-2024-11222 CVE-2026-12910 CVE-2026-82837 CVE-2026-19619 CVE-2026-86341 CVE-2026-86340 CVE-2026-7514 CVE-2026-8030 CVE-2026-16794 CVE-2026-3855

Tags: devops gitlab graphql path-traversal rce security-update

Vendors: GitLab
Products: GitLab CE GitLab EE

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-79708 +10 related CVEs CVE-2026-1168 CVE-2025-14871 CVE-2026-3855 CVE-2024-11222 CVE-2026-78252 CVE-2026-19619 CVE-2026-86341 CVE-2026-16794 CVE-2026-7514 CVE-2026-8030	GitLab EE Authorization Flaw Lets Developers Read Protected CI/CD Variables	8.5 group max	—		Sep 16, 2026
CVE-2026-88765 +3 related CVEs CVE-2026-13210 CVE-2026-12910 CVE-2026-82837	Authenticated RCE via Malicious Project Import in GitLab EE Advanced Search	8.5 group max	—		Sep 15, 2026
CVE-2026-85706	Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE	10.0	97%	KEVPoC ×13	Sep 12, 2026 KEV Sep 11, 2026
CVE-2026-86340		—	—		—
CVE-2026-87719	Authenticated GraphQL Subscription Flaw Leaks Search Credentials in GitLab EE	9.9	—		Sep 12, 2026

From the original article

3 min read at gbhackers.com

GitLab has issued an emergency security update to address two critical vulnerabilities that could lead to unauthenticated file disclosure and authenticated credential theft, as well as a high-severity flaw that may enable remote code execution. The company released updated versions of GitLab Community Edition and Enterprise Edition, specifically versions 19. 3.

GBHackers

By Divya · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.