Emerging Threats

GitLab Flaw Exploited After Patch Release

Analyst 207||Source: TheRegister
Rows of computer servers and storage equipment in a server room with visible cables and network connections.

CVE-2026-85706 is rated a perfect 10.0 — the maximum score on the CVSS v3.1 scale — for a path traversal bug in GitLab's repository commits API that can let unauthenticated attackers read arbitrary files from vulnerable servers.

GitLab's repository commits API: how the flaw works

GitLab says the defect is a path traversal vulnerability in the repository commits API that, under certain conditions, allows an attacker to read arbitrary files from the GitLab server without authenticating. GitLab blamed the problem on "improper path confinement combined with missing authentication enforcement in the affected API." That combination is especially consequential on a platform that often stores source code, configuration files and credentials.

Patch timeline and who needs to act

GitLab shipped fixes on September 10 in versions 19.3.2, 19.2.6 and 19.1.8. The bug affects:

  • versions from 18.7 before 19.1.8;
  • the 19.2 branch before 19.2.6; and
  • 19.3 before 19.3.2.

GitLab.com is already patched, and GitLab Dedicated customers "don't need to take action," the company said. Operators of affected self‑managed installations were urged to upgrade immediately to the fixed releases.

Exploitation in the wild: probes and simplicity

Security firm watchTowr reported over the weekend that it was "observing probes" for CVE-2026-85706. The firm warned that widespread exploitation was likely to follow quickly and said exploiting the flaw can be as simple as sending a single HTTP request, potentially allowing an attacker to access local files, configuration data, credentials and other secrets.

watchTowr advised organizations running internet‑facing self‑hosted GitLab instances either to patch them or to pull them from public access. Administrators investigating potential exploitation attempts should check logs for HTTP POST requests to /api/v4/projects/{{id}}/repository/commits/ that contain file.path parameters, watchTowr said.

CISA response and regulatory context

The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) catalog. CISA's public comment emphasized the risk to government systems: "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise."

CISA noted that Binding Operational Directive 26‑04 (BOD 26‑04) applies only to federal civilian executive branch (FCEB) agencies, but it "encourages all organizations to adopt risk‑based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities."

What this means for self‑hosted admins, federal agencies, and managed customers

  • Self‑hosted GitLab administrators: patch immediately to one of the fixed releases (19.3.2, 19.2.6 or 19.1.8) or, if that is not immediately possible, take internet‑facing instances offline; watchTowr explicitly recommended patching or pulling instances from public access and checking for POST requests to the repository commits endpoint with file.path parameters.
  • Federal agencies and organizations bound by CISA directives: the KEV catalog entry and CISA's statement elevate the vulnerability in prioritized remediation workflows; BOD 26‑04 applies only to FCEB agencies, but CISA is urging broader adoption of risk‑based practices.
  • GitLab managed customers: GitLab.com has been patched and GitLab Dedicated customers were told no action is required, reducing immediate exposure for those hosting with GitLab's managed services.

The vulnerability's maximum score and the reported ease of exploitation make this a high‑urgency event for any organization running self‑managed, internet‑facing GitLab instances. As the source reporting put it bluntly: for exposed, unpatched installations, "that upgrade belongs on today's to‑do list."

Original reporting: https://www.theregister.com/security/2026/09/14/perfect-10-gitlab-bug-under-attack-days-after-patch-lands/5296176

Emerging ThreatsSupply ChainVulnerability ManagementZero-DayAPI SecurityPath TraversalGitlabCVE-2026-85706
Related Intelligence

Continue Reading

Software development workspace with a lone, abstracted workstation in the foreground.

Rogue AI Agents Expose Security Gaps

AI is increasingly showing up in the wrong places, amplifying opportunities for harm as quickly as it creates new possibilities. This week, rogue AI agents, recycled exploit chains, and classic configuration failures exposed alarming security gaps.

Analyst 207
Rows of computer servers and networking equipment in a data center with a laptop on a technician's workstation.

Human Exploits Marimo Flaw to Breach SSH Bastion Host in 8 Seconds

In just 8 seconds, a human attacker exploited a vulnerability in Marimo notebooks to breach an SSH bastion host, showcasing the alarming speed and ease of lateral movement within compromised systems. This lightning-fast breach was achieved without the aid of AI tools, highlighting the severity of the CVE-2026-39987 flaw.

Analyst 207
Concerned person in office setting handles customer inquiry near computer.

Revolut Breach Exposes Sensitive Customer Data via Fake Government Requests

A scammer impersonated a government agency, tricking Revolut staff into spilling sensitive customer info through fake requests - a clever tactic known as a sophisticated external impersonation scam. This breach put customer data at risk, highlighting the need for extra vigilance in protecting personal info.

Analyst 207
Rows of computer servers and storage equipment in a brightly-lit data center with technicians in the background and a…

GitLab Flaw Exploited in Wild, Prompting Urgent Patch Push

A critical GitLab bug, CVE-2026-85706, is under active exploitation, putting sensitive files at risk of exposure due to a path traversal vulnerability that allows unauthenticated users to access arbitrary files. GitLab has urgently pushed a patch to fix the flaw, affecting versions CE/EE 18.7 to 19.3.2.

Analyst 207