GitLab has released emergency patches for two high-severity vulnerabilities in its software development platform, one of which carries the maximum possible severity score and is already being actively probed by attackers across the internet. The company urged operators of self-managed installations to upgrade immediately, while confirming its own hosted service and single-tenant Dedicated offering customers are not impacted.
The more critical of the two flaws, identified as CVE-2026-85706, affects the interface responsible for handling repository commits. This vulnerability, rated with a CVSS score of 10.0, allows an unauthenticated attacker to read any file on the server. The issue stems from improper file path confinement and a lack of authentication enforcement, meaning an attacker does not require an account or credentials to exploit it. This flaw impacts all GitLab releases from version 18.7 up to 19.1.8, as well as the 19.2 and 19.3 lines prior to the recent patches.
A security firm, WatchTowr Labs, reported on Friday that it had already observed internet-wide probes targeting this path traversal vulnerability. The firm stated that the exploit can be triggered with a single HTTP request. Organizations running self-hosted GitLab servers accessible from the open internet are at the highest risk. Defenders are advised to examine their logs for POST requests directed to paths under `/api/v4/projects/{id}/repository/commits/` that include a `file.path` parameter. The firm also cautioned that broad, untargeted exploitation often follows swiftly after a patch is released for GitLab vulnerabilities.
The second vulnerability, CVE-2026-87719, is rated with a CVSS score of 9.9 and exclusively affects GitLab's Enterprise Edition. This flaw enables a logged-in user with Duo Chat access to embed a command within a standard request. This command would then prompt the server to retrieve its own settings for the Advanced Search feature, consequently exposing sensitive information such as settings and passwords. This vulnerability affects Enterprise Edition releases from version 18.3 onwards.
GitLab has provided more detailed information regarding these vulnerabilities on its official website. The Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) list on Friday afternoon, further emphasizing the immediate threat they pose.
