GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

Tracked as CVE-2026-85706 and rated CVSS 10.0, the flaw affects GitLab's repository commits API. Researchers reported seeing in-the-wild probing within hours of the vulnerability's public disclosure.

The vulnerability results from improper path confinement combined with missing authentication enforcement. Under certain conditions, an attacker can send a crafted request to the affected API and retrieve files that should not be accessible.

Affected Versions

The vulnerability primarily affects self-managed GitLab installations running the vulnerable versions.

Exploitation Already Underway

Security researchers at watchTowr said they observed probes targeting the vulnerability from approximately 06:00 UTC on September 11, 2026, shortly after GitLab disclosed the flaw.

The researchers said exploitation can be performed with a single HTTP request and requires no authentication. They also noted that having at least one public project on the targeted GitLab instance is sufficient for exploitation.

What Attackers Could Steal

Successful exploitation could expose sensitive files from the GitLab server, potentially including:

• Configuration files
• Application logs
• SSH keys
• Database credentials
• Deploy tokens
• CI/CD secrets
• API credentials
• Other sensitive server-side information

Access to such data could provide attackers with credentials that enable further compromise of GitLab projects, development infrastructure or connected cloud environments.

CISA Adds the Flaw to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) catalog on September 11, confirming active exploitation.

U.S. federal civilian agencies have been given until September 14, 2026, to apply the available fixes.

Another Critical GitLab Vulnerability Patched

GitLab also addressed CVE-2026-87719, a critical insecure deserialization vulnerability in GitLab Enterprise Edition with a CVSS score of 9.9.

The flaw could allow an authenticated user with Duo Chat access to obtain Advanced Search configuration information and sensitive credentials through a specially crafted GraphQL subscription argument.

What Organizations Should Do

Organizations running self-managed GitLab should:

• Upgrade immediately to GitLab 19.3.2, 19.2.6 or 19.1.8, as appropriate.
• Prioritize internet-facing GitLab instances.
• Review GitLab and web-server logs for suspicious requests targeting the repository commits API.
• Investigate unexpected access to configuration and log files.
• Rotate potentially exposed API keys, deploy tokens, SSH keys and credentials.
• Review CI/CD secrets and connected cloud credentials.
• Check for suspicious changes to repositories, users, runners and deployment pipelines.
• Hunt for follow-on activity using credentials that may have been exposed.

With a CVSS score of 10.0, no authentication requirement, and exploitation already being observed, CVE-2026-85706 should be treated as an emergency patching priority for vulnerable self-managed GitLab deployments.

SEO Meta Description:
GitLab patches CVE-2026-85706, a CVSS 10 path traversal flaw allowing unauthenticated arbitrary file reads, as researchers observe in-the-wild exploitation.