GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets

GitLab has released patches for multiple high-severity flaws, including a CVSS 10.0 path traversal vulnerability (CVE-2026-85706) affecting the repository commits API. The flaw could allow an unauthenticated attacker to read arbitrary files from the GitLab server under certain conditions, due to improper path confinement and missing authentication enforcement in the repository commits API.

GitLab confirms that affected releases include all GitLab Community Edition (CE) and Enterprise Edition (EE) versions listed as: 18.7 before 19.1.8; 19.2 before 19.2.6; and 19.3 before 19.3.2. Pre-emptive exposure firm watchTowr reports active in-the-wild probing since 06:00 UTC on 11 September 2026, with attackers able to read log files and GitLab configuration files to obtain credentials and secrets. The risk is heightened by the potential to access source code, CI/CD secrets, and to inject or poison build pipelines downstream.

Patched releases for this issue are 19.3.2, 19.2.6, and 19.1.8. In addition, GitLab patched a critical insecure deserialization flaw in GitLab EE (CVE-2026-87719, CVSS 9.9) that could disclose information via a crafted GraphQL subscription argument to bypass serialization and server object lookups. Organisations running self-managed GitLab exposed to the internet should apply the patches immediately or restrict public access.

Defenders are advised to monitor for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ containing file[.]Path parameters as a potential exploitation signal.