GitLab has issued patches for several vulnerabilities, including a critical security flaw identified as CVE-2026-85706, which has been subjected to active exploitation shortly after its public announcement. This vulnerability, rated with a maximum CVSS score of 10.0, is a path traversal issue within the repository commits API that could permit unauthenticated users to read arbitrary files from the GitLab server under specific conditions.
The root cause of this vulnerability is attributed to improper path confinement and a lack of authentication enforcement in the repository commits API. It affects various versions of GitLab, specifically:
All versions from 18.7 before 19.1.8, all versions from 19.2 before 19.2.6, and all versions from 19.3 before 19.3.2.
Active Exploitation Observed
According to the exposure management firm watchTowr, probes exploiting this vulnerability have been detected since 06:00 UTC on September 11, 2026. The flaw allows external attackers to access sensitive information, including log files and GitLab-specific configuration files, which may contain credentials and secrets.
Context of the Vulnerability
Jake Knott, head of threat intelligence at watchTowr, noted that this incident marks the second critical vulnerability in GitLab in recent weeks, following a previous GraphQL code injection vulnerability (CVE-2026-19478) that was quickly exploited. He emphasized that exploitation of CVE-2026-85706 requires at least one public project to exist, making GitLab an appealing target for attackers.
Additional Vulnerabilities Addressed
In addition to CVE-2026-85706, GitLab has also patched a critical insecure deserialization bug (CVE-2026-87719) with a CVSS score of 9.9. This vulnerability could allow an authenticated user with Duo Chat access to retrieve sensitive configurations and credentials through a specially crafted GraphQL subscription argument.
Recommended Actions for Organizations
Organizations operating self-managed GitLab instances that are accessible via the internet are urged to apply the patches immediately or restrict public access if it is not necessary. WatchTowr’s Knott cautioned that the transition of this vulnerability to widespread exploitation is likely imminent, and defenders should act swiftly. He also recommended reviewing log files for any suspicious HTTP POST requests to ‘/api/v4/projects/{id}/repository/commits/’ URIs that include ‘file.Path’ parameters to detect potential exploitation attempts.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
