GITLAB disclosed CVE-2026-85706, a critical path-traversal vulnerability in its repository commits API, on 10 September 2026. Rated CVSS 10.0, the flaw can allow an unauthenticated attacker to read arbitrary files through a single crafted HTTP request. Exposed data could include SSH keys, database credentials, deploy tokens, CI/CD variables and other sensitive configuration information. All Community Edition and Enterprise Edition versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected.
The article says probing and exploitation attempts began by 11 September, while watchTowr reported seeing in-the-wild probes against public-facing, self-hosted GitLab installations. CISA has also added the vulnerability to its Known Exploited Vulnerabilities catalogue. Organisations should upgrade to a fixed version urgently or remove public access.
Defenders can review logs for HTTP POST requests to `/api/v4/projects/{id}/repository/commits/` containing `file.path` parameters, which may indicate exploitation attempts. After checking for signs of compromise, they should rotate credentials that may have been exposed, including tokens, SSH keys, CI/CD variables and cloud keys. The same update cycle also addresses CVE-2026-87719, an insecure deserialisation flaw that could expose advanced-search configuration and credentials.