For most engineering teams, GitLab is far more than a code host. It holds source code, CI/CD pipelines, deploy tokens, runner registrations, and the configuration that connects all of it to production. That makes a GitLab server one of the most valuable systems an attacker can reach — and CVE-2026-85706 hands unauthenticated attackers a way to read its files.
What Is the Vulnerability?
CVE-2026-85706 is a path traversal vulnerability (CWE-22) in the repository commits API of GitLab Community Edition (CE) and Enterprise Edition (EE). In GitLab's own words, "an unauthenticated user could read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API."
GitLab rated it CVSS 10.0 — the maximum possible score — with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. In plain terms: it is reachable over the network, easy to exploit, needs no privileges or user interaction, and its impact reaches beyond the vulnerable component itself. The issue was reported through GitLab's HackerOne bug bounty programme by the researcher s3ntago.
How It Works (High Level)
Two weaknesses combine in a single API endpoint (/api/v4/projects/:id/repository/commits):
- Missing authentication enforcement — the vulnerable code path can be reached without logging in.
- Improper path confinement — a file path supplied in the request is not properly kept inside the repository, so traversal sequences such as
../can walk out into the server's filesystem.
The result is that a crafted HTTP request can make GitLab return the contents of files that the GitLab service account is able to read. Researchers at watchTowr reported that the main prerequisite for the observed attack path is that the instance hosts at least one public project — which is common on internet-facing GitLab servers used for open-source or community work.
Potential Impact
An arbitrary file read sounds less dramatic than remote code execution, but on a DevOps platform it is often just as damaging. Depending on how the server is deployed and which files the GitLab service can read, an attacker may be able to retrieve:
- GitLab configuration files and the secrets embedded in them
- Access tokens, deploy tokens and CI/CD variables
- Application and service logs
- In some deployment layouts, SSH keys or database credentials
Stolen secrets are the real prize. With them, an attacker can move from "read a file" to pushing malicious code, tampering with pipelines, or accessing connected cloud and production systems — a software supply chain risk that extends well beyond the GitLab server itself.
Who Is Affected?
Self-managed GitLab CE and EE installations running any of the versions below are vulnerable. According to GitLab, GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action.
| Release line | Vulnerable versions | Fixed in |
|---|---|---|
| 18.7 – 18.11 | 18.7 before 18.11.12 | 18.11.12 |
| 19.0 | 19.0 before 19.0.9 | 19.0.9 |
| 19.1 | 19.1 before 19.1.8 | 19.1.8 |
| 19.2 | 19.2 before 19.2.6 | 19.2.6 |
| 19.3 | 19.3 before 19.3.2 | 19.3.2 |
GitLab first shipped fixes in 19.3.2, 19.2.6 and 19.1.8 on September 10, 2026. On September 23, 2026, it released backports in 19.0.9 and 18.11.12 — outside its normal maintenance policy — so administrators on those older lines could patch without first completing a major upgrade.
Exploitation Status
This vulnerability is being actively exploited. watchTowr observed internet-wide scanning and probing against the vulnerable endpoint beginning at 06:00 UTC on September 11, 2026 — roughly one day after the patches were published. The same day, CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) catalog, giving US federal civilian agencies a remediation deadline of September 14, 2026.
The window between patch and exploitation was about a day. If your instance was internet-facing and unpatched after September 10, you should assume it may have been probed.
Mitigation and Remediation
- Upgrade now to 19.3.2, 19.2.6, 19.1.8, 19.0.9 or 18.11.12 (or later). GitLab "strongly recommends" upgrading as soon as possible — don't wait for a maintenance window.
- Hunt in your logs for requests to
/api/v4/projects/:id/repository/commitscontaining path traversal sequences, especially from unauthenticated sources since September 10. GitLab has also published threat detections for this activity. - If you were exposed, rotate secrets — CI/CD variables, deploy and access tokens, runner tokens, SSH keys and database credentials that the GitLab server could read.
- Reduce exposure while patching — restrict the instance to VPN or trusted networks, and review whether public projects are actually needed.
- Add a WAF rule to block traversal sequences in requests to the repository commits API as a temporary safeguard — not a replacement for the patch.
Key Takeaways for Security Teams
- Patch-to-exploit time is now measured in hours. Critical fixes for internet-facing platforms need an emergency path, not the next monthly cycle.
- Treat DevOps platforms as crown jewels. GitLab, CI/CD runners and artifact stores hold the keys to production and deserve the same protection as identity systems.
- Patching is not the end of the incident. A file-read bug means secrets may already be gone; rotation and log review are part of remediation.
- Minimise what's public. Self-managed instances that don't need to be on the internet — or don't need public projects — shrink their attack surface dramatically.
- Keep secrets out of reach. Use a dedicated secrets manager and short-lived credentials so a single file read can't unlock everything.
In short: if you run self-managed GitLab, confirm you're on a fixed version today — and if you weren't patched by September 11, investigate and rotate.
References
- GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8 (September 10, 2026)
- GitLab Critical Patch Release: 19.0.9, 18.11.12 (September 23, 2026)
- CISA — Adds One Known Exploited Vulnerability to Catalog (September 11, 2026)
- CISA Known Exploited Vulnerabilities Catalog — CVE-2026-85706
- Rapid7 — CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild
- Cloud Security Alliance — Research Note: GitLab CVE-2026-85706
- CVE.org — CVE-2026-85706