What Changed
On September 10, 2026, GitLab shipped a critical patch release for Community Edition and Enterprise Edition fixing CVE-2026-85706, a CVSS 10.0 path traversal in the repository commits API. Under certain conditions, an unauthenticated remote attacker can read arbitrary files from the GitLab server because of improper path confinement and missing authentication enforcement on that API.
GitLab’s fixed builds are 19.3.2, 19.2.6, and 19.1.8. Affected: all CE/EE versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. GitLab.com and Dedicated are already patched; self-managed instances are on you.
By September 11, watchTowr reported in-the-wild probes for crafted POSTs to /api/v4/projects/{id}/repository/commits/ with file.path parameters. The same day, CISA added CVE-2026-85706 to the Known Exploited Vulnerabilities catalog with a federal remediation due date of September 14, 2026 and forensic triage required under BOD 26-04.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The same release also patches CVE-2026-87719 (insecure deserialization in GraphQL subscription serializer on EE, CVSS 9.9) among other fixes — another reason to take the full patch train rather than chase a one-off workaround.
Why This Matters Operationally
Self-hosted GitLab often holds the keys to the kingdom: SSH keys, deploy tokens, database credentials, CI/CD variables, and cloud secrets on disk. An unauthenticated file read against that surface is not a “read-only inconvenience” — it is a credential harvest with a short path to source and build systems.
GitLab has seen this movie before. CVE-2023-2825, another arbitrary file-read path traversal, was exploited within days of disclosure. CVE-2026-85706 compressed that window further: disclosure on the 10th, live probes by the 11th, KEV the same day, and a Monday federal due date.
What Defenders Should Verify First
- Upgrade every self-managed CE/EE instance to 19.1.8 / 19.2.6 / 19.3.2 (or newer) immediately. If you cannot patch today, remove public access until you can.
- Hunt HTTP access logs for POST requests to
/api/v4/projects/*/repository/commits/containingfile.pathparameters (watchTowr’s hunting hint). - After patching, rotate credentials that exposed files may have contained: tokens, SSH keys, CI/CD variables, cloud keys — and expand response if you find successful reads.
- Treat BOD 26-04 forensic triage as the bar for any internet-exposed instance that was reachable before the patch.
Source Context
- GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8
- CISA: Adds One Known Exploited Vulnerability (CVE-2026-85706)
- Security Affairs: CVE-2026-85706 exploited within 24 hours
- CISA KEV catalog entry for CVE-2026-85706
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
