Skip to content
OriginalSign in
Image: Dark Reading

Dark ReadingRob Wright

CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw

Part of the CVE-2026-85706 story · since 11 Sep

Quiet for 2 weekslast report 13 Oct12 articles8 outlets
11 Sep · SecurityOnline first8 Oct17 OctNowThis article10th of 12
  • Fri 11 Sep, 01:30 UTC. SecurityOnline, first report. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 16:30 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical GitLab Flaw Within a Day of Patches. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 17:37 UTC. The Hacker News, its first report on the story. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:33 UTC. CISA, its first report on the story. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 12:47 UTC. Security Affairs, its first report on the story. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 10:11 UTC. Infosecurity, its first report on the story. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 11:57 UTC. Rapid7, its first report on the story. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 21:05 UTC. Dark Reading, its first report on the story. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw. Cites a CVE in CISA KEV. This article, 10th of 12.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 09:12 UTC. The Hacker News. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.

GitLab vulnerability CVE-2026-85706 is being actively exploited after its disclosure and patching on 10 September 2026. The path-traversal flaw affects self-hosted GitLab Community Edition and Enterprise Edition instances and has a CVSS score of 10 out of 10. It stems from improper path confinement and missing authentication checks in the repository commits API, allowing unauthenticated attackers to read arbitrary files from a server.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on Friday, while watchTowr first observed behavioural probes and later reported full exploitation and theft of sensitive files. Attackers were seen targeting configuration files, secrets and SSH settings. Although the flaw provides read-only access, stolen credentials and CI/CD secrets could enable compromise of the GitLab instance, development environments and downstream systems. Exploitation requires at least one public project on the affected server, a configuration watchTowr described as common and potentially overlooked.

GitLab customers should upgrade self-hosted CE or EE installations to version 19.3.2, 19.2.6 or 19.1.8. If updating is not possible, watchTowr recommends removing all public access immediately and reviewing repository commits API logs for suspicious unauthenticated requests. GitLab says its hosted GitLab.com service has already been patched, while GitLab Dedicated customers do not need to act.

How the story developed

All 12 articles
Quiet for 2 weekslast report 13 Oct12 articles8 outlets

12 articles from 8 outlets since 11 Sep. Quiet since 13 Oct. This was the 10th report, 4 days after the first.

Now11 Sep1213141512 Oct13First reportSecurityOnline · 11 Sep, 01:30This article10th of 12 · day 3
  • Fri 11 Sep, 01:30 UTC. SecurityOnline, first report. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 16:30 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical GitLab Flaw Within a Day of Patches. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 17:37 UTC. The Hacker News, its first report on the story. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:33 UTC. CISA, its first report on the story. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 12:47 UTC. Security Affairs, its first report on the story. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 10:11 UTC. Infosecurity, its first report on the story. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 11:57 UTC. Rapid7, its first report on the story. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 21:05 UTC. Dark Reading, its first report on the story. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw. Cites a CVE in CISA KEV. This article, 10th of 12.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 09:12 UTC. The Hacker News. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 12 articles as a list
  1. Fri 11 SepDay 04
    1. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files01:30 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Attackers Exploit Critical GitLab Flaw Within a Day of Patches16:30 · SecurityWeek · Known exploited CVE
    3. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets17:37 · The Hacker News · Known exploited CVE
    4. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files20:33 · CISA · official · CISA alert · Known exploited CVE

  2. Quiet for 2 days

    Sun 13 SepDay 21
    1. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers12:47 · Security Affairs · Known exploited CVE
  3. Mon 14 SepDay 35
    1. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws03:11 · SecurityOnline · Known exploited CVE
    2. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw10:11 · Infosecurity · Known exploited CVE
    3. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw21:05 · Dark Reading · Known exploited CVE · This article, 10th of 12
    Show 2 more from 14 Sep
    1. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching11:57 · Rapid7 · Known exploited CVE
    2. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited15:26 · Security Affairs · Known exploited CVE

  4. Quiet for 4 weeks

    Mon 12 OctDay 311
    1. Actively Exploited Vulnerabilities Jump to 100 in Q3 202604:01 · SecurityOnline · Picked up again · Known exploited CVE
  5. Tue 13 OctDay 321
    1. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code09:12 · The Hacker News · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in