Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

GitLab Zero Day Lets Attackers Steal Secrets From Public Servers

Part of the CVE-2026-85706 story · since 11 Sep

Quiet for 2 weekslast report 13 Oct12 articles8 outlets
11 Sep · SecurityOnline first5 Oct13 Oct21 OctNowThis article5th of 12
  • Fri 11 Sep, 01:30 UTC. SecurityOnline, first report. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 16:30 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical GitLab Flaw Within a Day of Patches. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 17:37 UTC. The Hacker News, its first report on the story. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:33 UTC. CISA, its first report on the story. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 12:47 UTC. Security Affairs, its first report on the story. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers. Cites a CVE in CISA KEV. This article, 5th of 12.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 10:11 UTC. Infosecurity, its first report on the story. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 11:57 UTC. Rapid7, its first report on the story. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 21:05 UTC. Dark Reading, its first report on the story. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 09:12 UTC. The Hacker News. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.

GitLab disclosed CVE-2026-85706 on 10 September 2026, describing it as a path-traversal vulnerability in the repository commits API with a CVSS score of 10.0. A crafted HTTP request can reportedly allow unauthenticated attackers to read arbitrary files, potentially exposing SSH keys, database credentials, deploy tokens, CI/CD variables and other sensitive configuration data. The flaw affects Community Edition and Enterprise Edition releases before 19.1.8, 19.2.6 and 19.3.2 respectively.

Exploitation attempts were reportedly observed by 11 September, within 24 hours of disclosure, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalogue. watchTowr said it had seen internet probes targeting the flaw, although the article does not quantify successful compromises. Its recommended detection method is to search logs for HTTP POST requests to `/api/v4/projects/{id}/repository/commits/` containing `file.path` parameters.

Organisations running publicly accessible, self-hosted GitLab should upgrade immediately or remove public access. They should then investigate for compromise and rotate credentials contained in any files that may have been exposed, including tokens, SSH keys, CI/CD variables and cloud keys. The same update cycle also addresses CVE-2026-87719, an insecure-deserialisation flaw affecting advanced-search configuration and credentials.

How the story developed

All 12 articles
Quiet for 2 weekslast report 13 Oct12 articles8 outlets

12 articles from 8 outlets since 11 Sep. Quiet since 13 Oct. This was the 5th report, 2 days after the first.

Now11 Sep1213141512 Oct13First reportSecurityOnline · 11 Sep, 01:30This article5th of 12 · day 2
  • Fri 11 Sep, 01:30 UTC. SecurityOnline, first report. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 16:30 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical GitLab Flaw Within a Day of Patches. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 17:37 UTC. The Hacker News, its first report on the story. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:33 UTC. CISA, its first report on the story. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 12:47 UTC. Security Affairs, its first report on the story. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers. Cites a CVE in CISA KEV. This article, 5th of 12.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 10:11 UTC. Infosecurity, its first report on the story. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 11:57 UTC. Rapid7, its first report on the story. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 21:05 UTC. Dark Reading, its first report on the story. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 09:12 UTC. The Hacker News. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 12 articles as a list
  1. Fri 11 SepDay 04
    1. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files01:30 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Attackers Exploit Critical GitLab Flaw Within a Day of Patches16:30 · SecurityWeek · Known exploited CVE
    3. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets17:37 · The Hacker News · Known exploited CVE
    4. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files20:33 · CISA · official · CISA alert · Known exploited CVE

  2. Quiet for 2 days

    Sun 13 SepDay 21
    1. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers12:47 · Security Affairs · Known exploited CVE · This article, 5th of 12
  3. Mon 14 SepDay 35
    1. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws03:11 · SecurityOnline · Known exploited CVE
    2. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw10:11 · Infosecurity · Known exploited CVE
    3. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching11:57 · Rapid7 · Known exploited CVE
    Show 2 more from 14 Sep
    1. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited15:26 · Security Affairs · Known exploited CVE
    2. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw21:05 · Dark Reading · Known exploited CVE

  4. Quiet for 4 weeks

    Mon 12 OctDay 311
    1. Actively Exploited Vulnerabilities Jump to 100 in Q3 202604:01 · SecurityOnline · Picked up again · Known exploited CVE
  5. Tue 13 OctDay 321
    1. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code09:12 · The Hacker News · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in