GITLAB vulnerability CVE-2026-85706 is being actively exploited after its disclosure and patching on 10 September 2026. The path-traversal flaw affects self-hosted GitLab Community Edition and Enterprise Edition instances and has a CVSS score of 10 out of 10. It stems from improper path confinement and missing authentication checks in the repository commits API, allowing unauthenticated attackers to read arbitrary files from a server.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on Friday, while watchTowr first observed behavioural probes and later reported full exploitation and theft of sensitive files. Attackers were seen targeting configuration files, secrets and SSH settings. Although the flaw provides read-only access, stolen credentials and CI/CD secrets could enable compromise of the GitLab instance, development environments and downstream systems. Exploitation requires at least one public project on the affected server, a configuration watchTowr described as common and potentially overlooked.
GitLab customers should upgrade self-hosted CE or EE installations to version 19.3.2, 19.2.6 or 19.1.8. If updating is not possible, watchTowr recommends removing all public access immediately and reviewing repository commits API logs for suspicious unauthenticated requests. GitLab says its hosted GitLab.com service has already been patched, while GitLab Dedicated customers do not need to act.