GitLab CVE-2026-85706: One Request, No Login, Your Secrets on Disk

What Changed

On September 10, 2026, GitLab shipped a critical patch release for Community Edition and Enterprise Edition fixing CVE-2026-85706, a CVSS 10.0 path traversal in the repository commits API. Under certain conditions, an unauthenticated remote attacker can read arbitrary files from the GitLab server because of improper path confinement and missing authentication enforcement on that API.

GitLab’s fixed builds are 19.3.2, 19.2.6, and 19.1.8. Affected: all CE/EE versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. GitLab.com and Dedicated are already patched; self-managed instances are on you.

By September 11, watchTowr reported in-the-wild probes for crafted POSTs to /api/v4/projects/{id}/repository/commits/ with file.path parameters. The same day, CISA added CVE-2026-85706 to the Known Exploited Vulnerabilities catalog with a federal remediation due date of September 14, 2026 and forensic triage required under BOD 26-04.

The same release also patches CVE-2026-87719 (insecure deserialization in GraphQL subscription serializer on EE, CVSS 9.9) among other fixes, so take the full release rather than a one-off workaround.

Why This Matters Operationally

Self-hosted GitLab often stores SSH keys, deploy tokens, database credentials, CI/CD variables, and cloud secrets on disk. An unauthenticated file read can hand those credentials to an attacker, along with a short path to source and build systems.

GitLab has seen this movie before. CVE-2023-2825, another arbitrary file-read path traversal, was exploited within days of disclosure. CVE-2026-85706 compressed that window further: disclosure on the 10th, live probes by the 11th, KEV the same day, and a Monday federal due date.

What Defenders Should Verify First

• Upgrade every self-managed CE/EE instance to 19.1.8 / 19.2.6 / 19.3.2 (or newer) immediately. If you cannot patch today, remove public access until you can.
• Hunt HTTP access logs for POST requests to /api/v4/projects/*/repository/commits/ containing file.path parameters (watchTowr’s hunting hint).
• After patching, rotate credentials that exposed files may have contained: tokens, SSH keys, CI/CD variables and cloud keys. Widen the response if you find successful reads.
• Treat BOD 26-04 forensic triage as the bar for any internet-exposed instance that was reachable before the patch.

Source Context

• GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8
• CISA: Adds One Known Exploited Vulnerability (CVE-2026-85706)
• Security Affairs: CVE-2026-85706 exploited within 24 hours
• CISA KEV catalog entry for CVE-2026-85706

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].