GitLab has confirmed that a critical path traversal vulnerability, identified as CVE-2026-85706, is being actively exploited in the wild, with initial probes detected within 24 hours of its public disclosure. The flaw, which carries a CVSS score of 10.0, affects the repository commits API in GitLab Community Edition and Enterprise Edition.
The vulnerability allows an unauthenticated attacker to read arbitrary files on a vulnerable GitLab instance by sending a single, specially crafted HTTP request. This could expose highly sensitive information such as SSH keys, database credentials, deploy tokens, CI/CD variables, and other configuration data.
GitLab officially disclosed CVE-2026-85706 on September 10, 2026. By September 11, active exploitation attempts were already observed. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since added this flaw to its Known Exploited Vulnerabilities catalog, urging immediate action from affected organizations.
The vulnerability impacts all GitLab Community Edition and Enterprise Edition versions from 18.7 prior to 19.1.8, 19.2 prior to 19.2.6, and 19.3 prior to 19.3.2. GitLab has released patches to address the issue. Organizations operating public-facing, self-hosted GitLab instances are strongly advised to apply these updates without delay or, as an alternative, to restrict public access to their instances.
Security researchers have noted that the rapid exploitation of CVE-2026-85706 mirrors previous GitLab path traversal vulnerabilities, such as CVE-2023-2825, which also saw active attacks shortly after disclosure. This pattern underscores the urgency for organizations to address such critical flaws immediately.
In addition to patching, defenders should examine their log files for HTTP POST requests directed to `/api/v4/projects/{id}/repository/commits/` URIs that include `file.path` parameters. The presence of such parameters in these requests can indicate an attempted or successful exploitation of the vulnerability.
Organizations that suspect compromise or have confirmed exploitation are advised to rotate any credentials that may have been exposed, including tokens, SSH keys, CI/CD variables, and cloud keys. This step is crucial to mitigate further risk following a potential data breach.
The same update cycle that addresses CVE-2026-85706 also patches CVE-2026-87719, an insecure deserialization flaw. This separate vulnerability could expose advanced search configurations and associated credentials, providing an additional incentive for organizations to upgrade their GitLab instances.
