CISA Warns of Critical GitLab Vulnerability Exploited in Attacks
CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 to its KEV catalog, warning unauthenticated attackers can read arbitrary files including secrets.
CISA added CVE-2026-85706, an unauthenticated path traversal vulnerability (CWE-35) in the repository commits API of GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities catalog on September 11, 2026, with a remediation deadline of September 14, 2026. The flaw allows arbitrary file reads via improper path confinement, potentially exposing configuration files, access tokens, private keys, and CI/CD variables that enable further intrusion and supply chain compromise. CISA requires forensic triage under Binding Operational Directive 26-04 and urges defenders to review logs for traversal requests and rotate potentially exposed credentials after patching.
- CVE-2026-85706 is an unauthenticated path traversal (CWE-35) in GitLab CE/EE repository commits API enabling arbitrary file reads.
- CISA added the flaw to KEV on September 11, 2026, with a September 14 remediation deadline under BOD 26-04.
- Exposed files may include access tokens, private keys, CI/CD variables, and cloud secrets enabling deeper compromise.
- Defenders should hunt for traversal sequences in commits API logs and rotate PATs, deploy tokens, SSH keys, and cloud credentials.
- No ransomware use confirmed, but file reads support reconnaissance and credential theft for broader intrusions.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed. Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts. | 10.0 | 12% | KEV PoC ×9 |
| massLikely >1,000,000 aggregate users across hundreds of thousands of self-managed CE/EE deployments, with tens of thousands of instances directly exposed to the… |
Full article545 words · extracted from gbhackers.com · click to collapse
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical GitLab flaw, tracked as CVE-2026-85706, to its Known Exploited Vulnerabilities catalog after confirming it was exploited in attacks.
The issue affects both GitLab Community Edition and Enterprise Edition and requires urgent mitigation, particularly for internet-accessible GitLab instances.
CVE-2026-85706 is a path traversal vulnerability in GitLab’s repository commits API. An unauthenticated attacker can exploit improper path confinement and missing authentication enforcement to read arbitrary files from a vulnerable GitLab server.
CISA Warns of Critical GitLab Vulnerability
This weakness is associated with CWE-35, which covers improper path limitation that can allow an attacker to access files outside an intended directory.
Arbitrary file disclosure can be severe in a source-code management environment. Depending on GitLab’s deployment configuration and the affected service’s permissions, exposed files could include application configuration data, secrets, access tokens, private keys, environment variables, repository metadata, or other sensitive artifacts.
Attackers may use those materials to map internal infrastructure, access source code, steal credentials, or establish a path toward further compromise.
CISA added the vulnerability to its catalog on September 11, 2026, and set a remediation due date of September 14, 2026.
The agency instructed affected organizations to apply mitigations according to vendor guidance while complying with Binding Operational Directive 26-04, which prioritizes security updates based on risk. The advisory also marks the flaw as requiring forensic triage under BOD 26-04.
The short remediation window reflects the risk associated with a remotely exploitable, unauthenticated flaw in a platform frequently connected to software development, CI/CD workflows, package registries, deployment automation, and enterprise identity systems.
A compromised GitLab instance can give attackers a valuable foothold in the software supply chain, especially when stored project variables or automation credentials provide access to cloud accounts and production environments.
Organizations should identify every GitLab CE and EE deployment, including self-hosted instances, cloud-connected installations, development environments, and externally managed systems.
Security teams should prioritize assets exposed to the public internet and verify whether any instances are behind reverse proxies, web application firewalls, or single sign-on systems that may create a false assumption that the vulnerable API cannot be reached.
CISA said organizations should follow applicable BOD 26-04 guidance for cloud services or discontinue use of affected products if adequate mitigations are unavailable.
The agency also said stakeholders must evaluate each asset’s internet exposure and ensure adherence to federal patching requirements.
Because forensic triage is required, defenders should review GitLab and web-server logs for unusual unauthenticated requests to repository commits API endpoints, unexpected file-path parameters, traversal sequences, anomalous response sizes, and signs of follow-on credential use.
Teams should also rotate potentially exposed credentials, including personal access tokens, deploy tokens, CI/CD variables, SSH keys, and cloud access secrets, after remediation.
CISA has not indicated whether CVE-2026-85706 is being used in ransomware campaigns. The absence of confirmed ransomware use should not reduce urgency, since arbitrary file-read vulnerabilities can enable reconnaissance and credential theft that later support broader intrusion activity.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.
Text extracted automatically; images, tables and formatting may be missing. Original: https://gbhackers.com/cisa-warns-of-critical-gitlab-vulnerability-exploited-in-attacks/