GitLab security advisory (AV26-917)
Canada's Cyber Centre warns GitLab versions before 19.1.8, 19.2.6 and 19.3.2 are affected; CISA added CVE-2026-85706 to KEV.
The Canadian Centre for Cyber Security issued advisory AV26-917 on September 11, 2026, warning that GitLab versions prior to 19.1.8, 19.2.6, and 19.3.2 are affected by vulnerabilities. CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog on the same date. The Cyber Centre urges users and administrators to review the advisory links and apply GitLab's critical patch release updates.
- Advisory AV26-917 covers GitLab versions prior to 19.1.8, 19.2.6, and 19.3.2
- CISA added CVE-2026-85706 to the KEV catalog on September 11, 2026
- Administrators urged to apply GitLab critical patch release updates
- CVEs
- CVE-2026-85706
- Products
- GitLab
- Organizations
- Canadian Centre for Cyber Security
- Countries
- CanadaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
From the original article
1 min read at cyber.gc.ca
Serial Number: AV26-917 Date: September 11, 2026 As of September 10, 2026, GitLab is affected by vulnerabilities in the following product: GitLab Prior to 19. 1. 8 Prior to 19.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.