GitLab CVE-2026-85706: One Request, No Login, Your Secrets on Disk — Patch Deadline Is Today

What Changed

On September 10, 2026, GitLab shipped a critical patch release for Community Edition and Enterprise Edition fixing CVE-2026-85706, a CVSS 10.0 path traversal in the repository commits API. Under certain conditions, an unauthenticated remote attacker can read arbitrary files from the GitLab server because of improper path confinement and missing authentication enforcement on that API.

GitLab’s fixed builds are 19.3.2, 19.2.6, and 19.1.8. Affected: all CE/EE versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. GitLab.com and Dedicated are already patched; self-managed instances are on you.

By September 11, watchTowr reported in-the-wild probes for crafted POSTs to /api/v4/projects/{id}/repository/commits/ with file.path parameters. The same day, CISA added CVE-2026-85706 to the Known Exploited Vulnerabilities catalog with a federal remediation due date of September 14, 2026 and forensic triage required under BOD 26-04.

The same release also patches CVE-2026-87719 (insecure deserialization in GraphQL subscription serializer on EE, CVSS 9.9) among other fixes — another reason to take the full patch train rather than chase a one-off workaround.

Why This Matters Operationally

Self-hosted GitLab often holds the keys to the kingdom: SSH keys, deploy tokens, database credentials, CI/CD variables, and cloud secrets on disk. An unauthenticated file read against that surface is not a “read-only inconvenience” — it is a credential harvest with a short path to source and build systems.

GitLab has seen this movie before. CVE-2023-2825, another arbitrary file-read path traversal, was exploited within days of disclosure. CVE-2026-85706 compressed that window further: disclosure on the 10th, live probes by the 11th, KEV the same day, and a Monday federal due date.

What Defenders Should Verify First

• Upgrade every self-managed CE/EE instance to 19.1.8 / 19.2.6 / 19.3.2 (or newer) immediately. If you cannot patch today, remove public access until you can.
• Hunt HTTP access logs for POST requests to /api/v4/projects/*/repository/commits/ containing file.path parameters (watchTowr’s hunting hint).
• After patching, rotate credentials that exposed files may have contained: tokens, SSH keys, CI/CD variables, cloud keys — and expand response if you find successful reads.
• Treat BOD 26-04 forensic triage as the bar for any internet-exposed instance that was reachable before the patch.

Source Context

• GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8
• CISA: Adds One Known Exploited Vulnerability (CVE-2026-85706)
• Security Affairs: CVE-2026-85706 exploited within 24 hours
• CISA KEV catalog entry for CVE-2026-85706

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.