GitLab Critical Vulnerability Now Under Active Attack, CISA Warns

A maximum-severity flaw in GitLab‘s software is now being actively exploited just days after the company shipped a fix, prompting a rare emergency warning from US authorities. The GitLab critical vulnerability, tracked as CVE-2026-85706, lets unauthenticated attackers pull sensitive files straight off vulnerable servers, and the US Cybersecurity and Infrastructure Security Agency says real-world attacks are already underway.

Key takeaways

• GitLab patched a path traversal bug, CVE-2026-85706, on September 10, 2026, rating it a perfect 10.0 on the CVSS v3.1 scale.
• The flaw lets unauthenticated attackers read arbitrary files, including source code and credentials, from vulnerable self-managed servers.
• Affected releases include GitLab Community and Enterprise Edition versions before 19.1.8, 19.2.6, and 19.3.2; GitLab.com is already patched and GitLab Dedicated customers face no risk.
• CISA added the bug to its Known Exploited Vulnerabilities catalog after confirming active exploitation, and security firm watchTowr has spotted live probing.
• Exploitation can reportedly be triggered with a single crafted HTTP request to GitLab’s repository commits API.

Inside the GitLab critical vulnerability: what CVE-2026-85706 actually does

CVE-2026-85706 is a path traversal issue sitting inside GitLab‘s repository commits API, and it stems from two problems layered on top of each other: improper path confinement combined with missing authentication enforcement on that endpoint. Put together, those two weaknesses mean an attacker doesn’t necessarily need valid login credentials before pulling files off a targeted server.

GitLab assigned the bug the highest possible score on the CVSS v3.1 scale, a flat 10.0, reflecting how easily it can be triggered and how much damage it can do once exploited. For a platform that routinely stores source code, configuration files, and login credentials in one place, that combination is about as bad as it gets from a risk standpoint.

Which GitLab versions are affected, and what’s already fixed

The vulnerability touches GitLab Community Edition and Enterprise Edition running versions from 18.7 up to just before 19.1.8, the entire 19.2 branch prior to 19.2.6, and 19.3 releases before 19.3.2. GitLab pushed fixed builds across all three branches on September 10, urging operators of self-managed instances to upgrade without delay.

Cloud customers can breathe a little easier. GitLab.com was already patched by the time the advisory went public, and GitLab Dedicated customers don’t need to take any action at all. The exposure sits almost entirely with organizations running their own self-managed GitLab deployments, particularly those left reachable from the open internet.

Why CISA’s exploitation warning changes the urgency

CISA’s decision to add CVE-2026-85706 to its Known Exploited Vulnerabilities catalog confirms that this isn’t a theoretical risk anymore; it’s an active attack pattern. The agency’s KEV listing is reserved for flaws it has verified are being used in real-world intrusions, which pushes this GitLab critical vulnerability into a different category than a routine patch-and-forget advisory.

“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA said in its advisory. The agency noted that its binding directive, BOD 26-04, technically applies only to federal civilian executive branch agencies, but added that it “encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.”

That distinction matters. GitLab’s platform isn’t confined to government networks; it’s used across more than half of Fortune 100 companies and counts over 30 million registered users worldwide, according to figures cited by BleepingComputer. A flaw with this level of reach, paired with confirmed exploitation, is exactly the kind of scenario that tends to spread quickly once attackers realize how straightforward it is to weaponize.

watchTowr flags active probing days after the patch

Security firm watchTowr said over the weekend that it was already observing probes targeting CVE-2026-85706 in the wild, just days after GitLab’s fix went live. The firm warned that widespread exploitation was likely to follow quickly, a pattern that’s become familiar with severe, easily exploitable flaws in widely deployed developer platforms.

The gap between disclosure and mass exploitation is shrinking across the industry, and this case fits that trend. Once a proof-of-concept or exploitation method circulates, unpatched internet-facing instances tend to become targets within days rather than weeks.

How the exploit works and what administrators should do now

According to watchTowr, abusing the flaw can be as simple as sending a single crafted HTTP request to GitLab’s repository commits API. The malicious request targets the endpoint /api/v4/projects/{id}/repository/commits/, manipulating file path parameters to trick the server into returning files it should never expose, potentially including local configuration data, credentials, and other secrets stored on the server.

That level of simplicity is precisely what worries researchers. There’s no need for a sophisticated exploit chain or advanced tooling, just a well-formed request against an exposed endpoint.

Recommended mitigation steps

Security researchers and CISA point to the same immediate priorities for organizations running self-managed GitLab instances:

• Upgrade affected Community Edition and Enterprise Edition installations to 19.3.2, 19.2.6, or 19.1.8 immediately.
• Restrict or remove public internet access to self-hosted GitLab instances that can’t be patched right away.
• Review server logs for suspicious HTTP POST requests to the repository commits API containing manipulated file.path parameters, a key indicator of attempted exploitation.

For any organization still running an exposed, unpatched GitLab server, closing this gap now is a far better outcome than discovering later what an attacker managed to pull from it.

FAQ

What is the nature of the GitLab vulnerability CVE-2026-85706?

It is a path traversal bug in the repository commits API that allows unauthenticated attackers to read arbitrary files from vulnerable GitLab servers.

Which GitLab versions are affected by the vulnerability?

GitLab Community Edition versions before 19.1.8, and Enterprise Edition versions before 19.2.6 and 19.3.2 are affected.

Has the vulnerability been actively exploited?

Yes, CISA has confirmed active exploitation, and the security firm watchTowr has observed probes exploiting the flaw in the wild.

What should administrators do to protect GitLab servers?

Administrators should apply the patches released on September 10, 2026, and monitor logs for suspicious HTTP POST requests to the repository commits API.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.