GitLab CVE-2026-85706: CVSS 10 Unauthenticated File Read, Exploited in the Wild

Marcus Chen Staff Engineer (Backend & Cloud), YuSMP Group · Infrastructure security for US and EU enterprise teams

The short answer

What is CVE-2026-85706?

GitLab is where most software teams keep their crown jewels: source code, merge requests, CI/CD pipelines, and the secrets those pipelines need to reach production. On September 10, 2026, GitLab published a security release fixing CVE-2026-85706, a critical path-traversal vulnerability in the repository commits API scored the maximum CVSS 10.0. It affects both the free Community Edition and the paid Enterprise Edition across a wide band of recent versions.

The flaw sits in the API that serves repository commit data. Because of improper path confinement and missing authentication enforcement, an attacker can send a single HTTP POST to /api/v4/projects/{id}/repository/commits/ with a path parameter that traverses out of the repository and points at any file the GitLab process can read. No login, no token, no user interaction — the request is answered before authentication is enforced. The only precondition is that the instance has at least one public project, which is true for the vast majority of real-world deployments. Because this is server-side infrastructure, hardening it is a DevOps and platform concern as much as an application one.

GitLab.com, the vendor-hosted SaaS, is already patched, so the danger is concentrated in the estimated 20,000-plus self-managed GitLab instances running worldwide — the on-prem and self-hosted servers that companies operate themselves. GitLab corrected the issue in releases 19.3.2, 19.2.6, and 19.1.8, which enforce proper path confinement and authentication on the commits endpoint.

How one request reads any file

Path traversal is one of the oldest classes of web bug, and CVE-2026-85706 is a textbook example with a modern blast radius. An API is supposed to confine file access to a specific directory — here, the data for a given repository. When the code that resolves a caller-supplied path fails to normalise and confine it, sequences that climb up the directory tree let the request escape the intended folder and reference files elsewhere on the disk. The commits API took a path parameter and used it without adequately confining where it could point.

What turns a common bug into a CVSS 10.0 emergency is the combination of factors. The endpoint answers before authentication is enforced, so no credentials are needed. It takes a single POST request, so the attack is trivial to automate at internet scale. And it runs with the privileges of the GitLab process, which can read the server's log files and configuration. Those files are exactly where the good stuff lives: database connection strings, object-storage keys, the instance secret used to sign tokens, and fragments of credentials that leak into logs. Read those, and an attacker no longer needs the file-read bug — they have valid keys.

This is not theoretical. A watchTowr honeypot network observed in-the-wild exploitation attempts beginning around 06:00 UTC on September 11, 2026, roughly six hours after disclosure. The same day, CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04, giving US federal civilian agencies until September 14, 2026 to remediate. When a maximum-severity flaw goes from advisory to active scanning inside a morning, the window to patch calmly has already closed.

What it means for US & EU software teams

Strip away the CVE number and three durable lessons remain. First, your source-code server is production infrastructure, not a developer convenience. Teams pour authentication, WAFs, and rate limiting onto customer-facing apps, then run a self-hosted GitLab on a permissive network because “it’s just our repos.” But that box holds the credentials to your cloud and the code that becomes production. It deserves the same threat model as your edge — and the same patch urgency.

Second, a file read is a secret read, and a secret read is a supply-chain event. The reason this flaw is scored as high as a remote code execution bug is that the files it exposes contain the keys to everything downstream. Once CI/CD variables, deploy tokens, or signing material leak, an attacker can move into your cloud accounts or tamper with the artifacts you ship to customers. That is why patching alone is insufficient here: if the instance was reachable, you have to assume secrets left the building and rotate them.

Third, network exposure is the multiplier, and time is the enemy. The difference between “critical CVE we patched calmly” and “incident” is almost always whether the vulnerable service was reachable from where the attacker sits, and how fast you moved. For EU teams, unauthenticated exfiltration of secrets and source from a system holding personal or financial data is squarely a GDPR, NIS2, and DORA concern — regulators expect that surface to be segmented and patched on a documented, rapid cadence. Knowing exactly which internal services are internet-reachable, and being able to patch them within hours, is the highest-leverage control you can invest in.

What to do now

1. Patch to a fixed release immediately. Move any self-managed GitLab on an affected version — 18.7–19.1.7, 19.2.0–19.2.5, or 19.3.0–19.3.1 — to 19.3.2, 19.2.6, or 19.1.8. Treat it as an emergency change, not routine maintenance.
2. Rotate secrets on the assumption of exposure. If the instance was internet-reachable, rotate CI/CD variables, deploy and access tokens, database and object-storage credentials, the GitLab instance secret, and any cloud keys stored in pipelines. Patching stops future reads; it does not un-leak what was already taken.
3. Get GitLab off untrusted networks. A source-code server should be reachable only from trusted subnets or behind a VPN or zero-trust proxy. If public internet access is not a hard requirement, remove it — that alone neutralises this class of attack.
4. Hunt for exploitation. Review access logs for POST requests to /api/v4/projects/{id}/repository/commits/ with unusual or traversal-style path parameters, and look for unexpected repository clones or newly created tokens. Preserve logs before they roll over.
5. Add your DevOps tier to security testing. Self-hosted GitLab, registries, and CI runners are routinely left out of scope even though they hold the most sensitive assets. Include them in your next penetration test and audit adjacent internal services for similar pre-auth paths.

Frequently asked questions

Sources

The Hacker News — GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
Forkast — GitLab’s CVSS 10 Commits-API Flaw Hits Active Exploitation Within Hours
CISA — Known Exploited Vulnerabilities Catalog