CISA Warns of Critical GitLab Vulnerability Exploited in Attacks
CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 to its KEV catalog, warning unauthenticated attackers can read arbitrary files including secrets.
CISA added CVE-2026-85706, an unauthenticated path traversal vulnerability (CWE-35) in the repository commits API of GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities catalog on September 11, 2026, with a remediation deadline of September 14, 2026. The flaw allows arbitrary file reads via improper path confinement, potentially exposing configuration files, access tokens, private keys, and CI/CD variables that enable further intrusion and supply chain compromise. CISA requires forensic triage under Binding Operational Directive 26-04 and urges defenders to review logs for traversal requests and rotate potentially exposed credentials after patching.
- CVE-2026-85706 is an unauthenticated path traversal (CWE-35) in GitLab CE/EE repository commits API enabling arbitrary file reads.
- CISA added the flaw to KEV on September 11, 2026, with a September 14 remediation deadline under BOD 26-04.
- Exposed files may include access tokens, private keys, CI/CD variables, and cloud secrets enabling deeper compromise.
- Defenders should hunt for traversal sequences in commits API logs and rotate PATs, deploy tokens, SSH keys, and cloud credentials.
- No ransomware use confirmed, but file reads support reconnaissance and credential theft for broader intrusions.
- CVEs
- CVE-2026-85706
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
From the original article
2 min read at gbhackers.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical GitLab flaw, tracked as CVE-2026-85706, to its Known Exploited Vulnerabilities catalog after confirming it was exploited in attacks.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.