506/69 Tuesday, September 15, 2026
GitLab disclosed CVE-2026-85706 on September 10, 2026. The vulnerability has a CVSS score of 10.0 and is a path traversal flaw in GitLab’s Repository Commits API. It could allow an unauthenticated attacker to send a single specially crafted HTTP request to read files that should not be accessible, such as SSH keys, database credentials, deploy tokens, CI/CD variables, and other sensitive configuration data.
Within 24 hours of disclosure, scanning and exploitation attempts targeting the vulnerability were observed. Researchers from watchTowr stated that they detected probing of CVE-2026-85706 in real-world systems and advised organizations using internet-exposed self-hosted GitLab instances to apply patches immediately or restrict external access. CISA has also added the vulnerability to its Known Exploited Vulnerabilities Catalog, indicating that it should be treated as an urgent risk and not left unaddressed until broader exploitation occurs.
The vulnerability affects GitLab Community Edition and Enterprise Edition from version 18.7 before 19.1.8, version 19.2 before 19.2.6, and version 19.3 before 19.3.2. Administrators should review logs for HTTP POST requests sent to /api/v4/projects/{id}/repository/commits/ that include the file.path parameter, as this may indicate exploitation attempts. After applying patches, administrators should check for signs of compromise and rotate any credentials that may have been stored in readable files, such as tokens, SSH keys, CI/CD variables, and cloud keys. The same update also fixes CVE-2026-87719, an insecure deserialization vulnerability that could expose advanced search configuration data and credentials.