60
60
60
Perfect-10 GitLab bug under attack days after patch lands
CISA confirms active exploitation of CVSS 10.0 GitLab path traversal flaw CVE-2026-85706 days after patches shipped, enabling unauthenticated arbitrary file reads.
CISA added CVE-2026-85706, a maximum-severity 10.0 CVSS path traversal flaw in GitLab's repository commits API, to its Known Exploited Vulnerabilities catalog and confirmed active exploitation. The bug allows unauthenticated attackers to read arbitrary files, including configuration data and credentials, from self-managed GitLab CE/EE servers via a single HTTP POST request. GitLab shipped fixes on September 10 in versions 19.3.2, 19.2.6, and 19.1.8, covering versions 18.7 through 19.3. watchTowr is observing probes against internet-facing instances and warns widespread exploitation is likely to follow quickly.
90
60
Maximum Severity GitLab Flaw Puts Supply Chains at Risk
GitLab CVE-2026-85706 is a maximum-severity CVSS 10.0 path traversal flaw affecting Community and Enterprise Editions, risking supply chain compromise.
CVE-2026-85706 is a path traversal vulnerability with a CVSS score of 10.0 affecting GitLab Community Edition and Enterprise Edition instances. Exploitation could enable attackers to tamper with repositories, posing software supply chain risks. The report does not mention active exploitation.
60
60
U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to the KEV catalog with imminent deadlines.
CISA added CVE-2026-42016 and CVE-2026-42018 (JFrog Artifactory), CVE-2026-84869 (ConnectWise ScreenConnect), and CVE-2026-85706 (GitLab, CVSS 10.0) to its KEV catalog. Artifactory flaws are being chained with CVE-2026-82329 in attacks observed August 15 to September 8, taking over self-hosted servers, creating persistent administrator accounts, and installing backdoors. ScreenConnect CVE-2026-84869 allows unauthorized file transfer and execution during remote sessions, linked by Huntress to malicious VBScript deliveries, and is fixed in version 26.6.5. GitLab's repository commits API path traversal exposes SSH keys, database credentials, deploy tokens, and CI/CD variables, with watchTowr already observing in-the-wild probes. Federal agencies must patch GitLab and ScreenConnect flaws by September 14, 2026, and Artifactory flaws by September 25, 2026.
82
GitLab urges users to patch max severity path traversal flaw
GitLab urges self-managed users to immediately patch a maximum-severity path traversal flaw (CVE-2023-2825) enabling unauthenticated arbitrary file reads.
GitLab released patches in CE/EE versions 19.3.2, 19.2.6, and 19.1 for CVE-2023-2825, a maximum-severity path traversal vulnerability that lets unauthenticated attackers read arbitrary files from vulnerable servers under certain conditions. The flaw, reported by researcher s3ntago via HackerOne, stems from improper path confinement and missing authentication enforcement in the repository commits API. GitLab also patched CVE-2026-87719, an insecure deserialization flaw in the GraphQL subscription serializer affecting Enterprise Edition users with Duo Chat access, which could expose credentials and Advanced Search configurations. GitLab.com and Dedicated customers are already protected; the platform has over 30 million registered users and is used by more than 50% of Fortune 100 companies.
65
60
CISA Warns of Critical GitLab Vulnerability Exploited in Attacks
CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 to its KEV catalog, warning unauthenticated attackers can read arbitrary files including secrets.
CISA added CVE-2026-85706, an unauthenticated path traversal vulnerability (CWE-35) in the repository commits API of GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities catalog on September 11, 2026, with a remediation deadline of September 14, 2026. The flaw allows arbitrary file reads via improper path confinement, potentially exposing configuration files, access tokens, private keys, and CI/CD variables that enable further intrusion and supply chain compromise. CISA requires forensic triage under Binding Operational Directive 26-04 and urges defenders to review logs for traversal requests and rotate potentially exposed credentials after patching.
80
Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code
GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.
GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.
74
A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove
GitLab patched maximum-severity CVE-2026-85706, an unauthenticated path traversal enabling arbitrary file reads; CISA added it to KEV amid observed in-the-wild probes.
CVE-2026-85706 is a CVSS 10.0 path traversal in GitLab's repository commits API caused by improper confinement and missing authentication enforcement, allowing arbitrary file reads in a single unauthenticated HTTP request. It affects GitLab CE and EE versions 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, and was reported via GitLab's HackerOne bug bounty. CISA added the flaw to its Known Exploited Vulnerabilities catalog, and watchTowr Intel reports already observing in-the-wild probes; GitLab is used by roughly 50% of the Fortune 100 with over 50 million registered users. Defenders are advised to patch immediately, rotate any exposed secrets, and hunt logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ URIs containing file.path parameters.
88
Urgent: GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Job Execution
60
CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks
CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 (CVSS 10.0) to its KEV catalog, setting a September 14 federal patch deadline.
CISA added CVE-2026-85706, a CVSS 10.0 path traversal vulnerability in GitLab's repository commits API, to its Known Exploited Vulnerabilities catalog on September 11, 2026. The flaw affects GitLab CE/EE versions 18.7-19.1.7, 19.2-19.2.5, and 19.3-19.3.1, allowing unauthenticated attackers to read arbitrary files from affected servers without user interaction. Fixes are available in GitLab 19.1.8, 19.2.6, and 19.3.2, and federal civilian agencies must remediate by September 14, 2026 under Binding Operational Directive 26-04. GitLab credited researcher s3ntago via HackerOne; arbitrary file disclosure could expose credentials, tokens, and CI/CD secrets useful for follow-on intrusions.
88
Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)
GitLab patched a critical unauthenticated code injection flaw CVE-2026-19478 (CVSS 9.4) enabling modification or deletion of public projects; upgrades urged.
GitLab released patches for two vulnerabilities affecting Community Edition (CE) and Enterprise Edition (EE) versions 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. CVE-2026-19478 (CVSS 9.4) is an unauthenticated code injection via a GraphQL directive, exploitable remotely without user interaction, allowing attackers to modify or delete public projects and user data. CVE-2026-19650 (CVSS 7.1) is a cross-site request forgery issue in the GraphQL multiplex query handler allowing mutations via GET requests with user interaction. Fixes are available in 18.11.11, 19.0.8, 19.1.6, and 19.2.4; both flaws were reported via GitLab's HackerOne bug bounty program.
65
CVE-2026-85706 | GitLab CE/EE Repository Commits API Path Traversal Vulnerability
GitLab patches CVSS 10.0 path traversal CVE-2026-85706 letting unauthenticated attackers read arbitrary files on self-managed CE/EE servers.
GitLab disclosed CVE-2026-85706, a CVSS 3.1 10.0 path traversal flaw in the repository commits API of self-managed GitLab CE/EE (18.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2), exploitable without authentication to read arbitrary server files. Successful exploitation can expose credentials, tokens, SSH keys, and database credentials accessible to the GitLab process. Fixed versions 19.1.8, 19.2.6, and 19.3.2 were released September 10, 2026; GitLab.com and Dedicated were already patched and no workaround is provided. Horizon3 released a NodeZero Rapid Response test to validate exposure and advises credential rotation for internet-facing instances.
75
60
60
GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure
Unauthenticated attackers are actively exploiting GitLab CVE-2026-19478 (CVSS 9.4) to modify or delete public projects days after disclosure.
GitLab CVE-2026-19478, a CVSS 9.4 code injection flaw exploitable via a GraphQL directive without authentication, allows attackers to modify or delete publicly accessible projects, rewrite repository data, forge merge records, and ban maintainers. Affected versions include GitLab CE/EE 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. watchTowr reproduced the flaw within minutes of disclosure and observed in-the-wild exploitation against its honeypot network. Fixes shipped in 19.2.4, 19.1.6, 19.0.8, and 18.11.11; interim mitigations include restricting unauthenticated access to /api/graphql or removing public repository access.
84
CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild
CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in GitLab CE/EE, is actively exploited and was added to CISA's KEV catalog.
GitLab patched CVE-2026-85706, a critical path traversal (CWE-22) in the repository commits API scoring CVSSv3.1 10.0, allowing unauthenticated arbitrary file reads on affected self-managed servers under certain conditions. CISA added it to the KEV catalog on September 11, 2026, citing active exploitation, with a September 14 remediation deadline and BOD 26-04 forensic triage requirements. Fixed versions are 19.1.8, 19.2.6, and 19.3.2; the release also fixes 17 other vulnerabilities including CVE-2026-87719, a CVSS 9.9 insecure deserialization flaw in GitLab EE.
88
60
60
60
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
GitLab patched CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal enabling arbitrary file reads, already probed in the wild.
GitLab released patches for a maximum-severity path traversal flaw (CVE-2026-85706, CVSS 10.0) in the repository commits API, caused by improper path confinement and missing authentication enforcement, allowing unauthenticated arbitrary file reads. watchTowr observed active in-the-wild probes starting 06:00 UTC on September 11, 2026; exploitation requires at least one public project and enables theft of credentials, secrets, and configuration data. GitLab also patched CVE-2026-87719 (CVSS 9.9), an insecure deserialization bug in Enterprise Edition allowing authenticated Duo Chat users to access Advanced Search configurations and sensitive credentials via crafted GraphQL subscription arguments. Affected versions include 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, and the flaw follows the recently exploited GraphQL code injection bug CVE-2026-19478.
80
GitLab Releases Patch for Critical CI/CD Pipeline Vulnerability and 13 Others
60
60
60
Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)
60
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-85706, an actively exploited GitLab path traversal flaw, to its KEV Catalog, requiring federal agencies to prioritize patching.
CISA added one vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-85706, a path traversal vulnerability in GitLab Community Edition and Enterprise Edition. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets, including checking whether systems were compromised before the patch was applied. While BOD 26-04 binds only FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediations.
72
60
60
60
60
60
60
GitLab Vulnerability Exploited One Day After Disclosure
WatchTowr observed in-the-wild exploitation of critical GitLab path traversal CVE-2026-85706 one day after disclosure, letting unauthenticated attackers read arbitrary files.
WatchTowr detected the first in-the-wild probes for CVE-2026-85706 (CVSS 10.0), an unauthenticated path traversal in GitLab CE/EE that allows arbitrary file reads via a single HTTP request, and warns mass exploitation is likely. Affected versions include 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The fresh patches also fix 17 other vulnerabilities, including CVE-2026-87719 (CVSS 9.9), an insecure deserialization flaw in the GraphQL subscription serializer exposing Advanced Search credentials, plus six high-severity bugs enabling RCE, CI/CD variable access, XSS, and denial of service.
85
60
CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog
60
U.S. CISA adds SolarWinds Web Help Desk, Sangoma FreePBX, and GitLab flaws to its Known Exploited Vulnerabilities catalog
60