GitLab’s critical flaw is already drawing internet-wide probes
GitLab patches two critical flaws (CVE-2026-85706 CVSS 10.0, CVE-2026-87719) as WatchTowr observes internet-wide probing of the unauthenticated file-read bug.
GitLab released emergency patches for two high-severity flaws in Community and Enterprise Editions, urging self-managed operators to upgrade immediately while saying its hosted and Dedicated offerings are fixed or unaffected. CVE-2026-85706 (CVSS 10.0) is a path traversal in the repository commits interface that lets unauthenticated attackers read any file on the server and affects releases 18.7 through 19.1.8 plus the 19.2 and 19.3 lines before patching. CVE-2026-87719 (CVSS 9.9, Enterprise Edition only) lets a logged-in Duo Chat user hide a command in a request that triggers Advanced Search settings and password disclosure. WatchTowr Labs reported it is already watching probes that can trigger the path traversal flaw in a single HTTP request, though CISA had not added either issue to the KEV list as of Friday afternoon.
- CVE-2026-85706 (CVSS 10.0) enables unauthenticated arbitrary file reads via the commits interface
- CVE-2026-87719 (CVSS 9.9) lets Duo Chat users leak Advanced Search settings and passwords in Enterprise Edition
- WatchTowr observed internet-wide probing; expect indiscriminate exploitation soon based on past GitLab flaws
- Defenders should watch POSTs to /api/v4/projects/{id}/repository/commits/ with a file.path parameter
- Self-managed installations must upgrade immediately; GitLab.com already runs fixed code
- Vendors
- GitLabWatchTowr LabsCISA
- Organizations
- GitLabWatchTowr LabsCISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
| CVE-2026-87719 | Authenticated GraphQL Subscription Flaw Leaks Search Credentials in GitLab EE | 9.9 | — |
From the original article
3 min read at cyberscoop.com
One flaw allows an unauthenticated attacker to read files from the server. GitLab urged operators of self-managed installations to upgrade immediately. The post GitLab’s critical flaw is already drawing internet-wide probes appeared first on CyberScoop.
By Greg Otto · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.