GitLab races to patch maximum severity path traversal flaw as CISA confirms exploitation

A maximum severity security flaw in GitLab's repository commits API is forcing urgent patching across the company's user base after the U.S. government confirmed active exploitation. The vulnerability, tracked as CVE-2026-85706, carries a CVSS score of 10.0, the highest possible severity rating from the Common Vulnerability Scoring System. It affects both GitLab Community Edition and Enterprise Edition, and GitLab has released patches in versions 19.1.8, 19.2.6, and 19.3.2.

CISA said on September 11, 2026 that it added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The agency ordered federal civilian executive branch agencies to apply fixes by September 14, 2026, a three day window that underscores the urgency. The KEV catalog entry describes the flaw as a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to improper path confinement and missing authentication enforcement in the repository commits API.

The flaw was discovered by a security researcher using the handle s3ntago and reported through GitLab's HackerOne bug bounty program. Security firm watchTowr observed in the wild probes targeting the vulnerability starting at 06:00 UTC on September 11, 2026, just hours after public disclosure. That rapid scanning activity suggests attackers are actively hunting for unpatched, internet exposed GitLab servers.

GitLab's platform is used by more than 30 million registered users and is deployed at over 50 percent of Fortune 100 companies, including Nvidia, Airbus, T-Mobile, Lockheed Martin, Goldman Sachs, and UBS. That enormous footprint means a maximum severity flaw with a simple exploitation path could have far reaching consequences across the software supply chain.

Key Facts

CVE-2026-85706 is a path traversal vulnerability in GitLab's repository commits API. GitLab stated the problem stems from improper path confinement and missing authentication enforcement. The flaw is associated with CWE-35, which covers improper limitation of a pathname to a restricted directory. An unauthenticated attacker can exploit it to read arbitrary files, which may include application configuration data, secrets, access tokens, private keys, environment variables, repository metadata, or other sensitive artifacts.

The vulnerability affects all GitLab Community Edition and Enterprise Edition versions from 18.7 before 19.1.8, from 19.2 before 19.2.6, and from 19.3 before 19.3.2. GitLab released patches in versions 19.1.8, 19.2.6, and 19.3.2. GitLab.com already runs the patched version, and GitLab Dedicated customers do not need to act. Self managed installations, however, are strongly urged to upgrade immediately.

Alongside CVE-2026-85706, GitLab patched a second critical flaw, CVE-2026-87719, an insecure deserialization bug in the GraphQL subscription serializer affecting GitLab Enterprise Edition. That flaw carries a CVSS score of 9.9 and could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument.

watchTowr reported on September 11 that the vulnerability allows attackers to read arbitrary files in a single HTTP request. Jake Knott, head of threat intelligence at watchTowr, said in a statement shared with The Hacker News that this is the second instance of a critical severity GitLab vulnerability in recent weeks, following the previous GraphQL code injection (CVE-2026-19478) that was almost immediately actively exploited. He added that exploitation requires just one requirement: at least one public project must exist. He also said that unauthorized access allows attackers to gain access to source code, CI/CD secrets, and credentials, and the ability to inject code into build pipelines.

watchTowr recommended that defenders review log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.Path' parameters to identify potential exploitation attempts. BleepingComputer reported on September 11 that the flaw allows attackers to read arbitrary files in a single HTTP request and that the time until indiscriminate exploitation is likely not far away, based on recent GitLab vulnerabilities.

Analysis

The speed at which attackers began probing CVE-2026-85706 is striking. watchTowr observed in the wild probes starting at 06:00 UTC on September 11, 2026, the same day GitLab disclosed the flaw. That timeline leaves defenders with almost no breathing room. The bigger picture here is that unauthenticated, maximum severity path traversal bugs in widely deployed developer platforms are no longer theoretical risks. They are operational emergencies.

What makes this flaw especially dangerous is the low barrier to exploitation. Jake Knott of watchTowr noted that exploitation requires just one condition: at least one public project must exist. Many GitLab instances, especially those used for open source projects or public repositories, meet that condition by default. An attacker does not need credentials, does not need to trick a user, and can read files in a single HTTP request. The resulting access to credentials, secrets, and CI/CD variables can turn a single vulnerable server into a gateway for supply chain attacks.

The Hacker News reported on September 11 that the issue allows an external attacker to read log files and GitLab specific configuration files to obtain credentials, secrets, and sensitive information. This is not just about data exposure. It is about lateral movement and pipeline injection. If an attacker can read CI/CD secrets, they can potentially inject code into build pipelines, compromising software that downstream customers trust.

CISA's decision to add the flaw to the KEV catalog on September 11, 2026, with a remediation deadline of September 14, 2026, reinforces the severity. The three day deadline for federal agencies is unusually short, signaling that CISA believes exploitation is imminent or already underway. GBHackers reported on September 12 that a compromised GitLab instance can give attackers a valuable foothold in the software supply chain, especially when stored project variables or automation credentials provide access to cloud accounts and production environments.

Why It Matters

GitLab is not a niche tool. It is used by more than 30 million registered users and is deployed at over 50 percent of Fortune 100 companies, including Nvidia, Airbus, T-Mobile, Lockheed Martin, Goldman Sachs, and UBS. A maximum severity vulnerability in such a widely used platform can have cascading effects across many sectors, from aerospace to finance to telecommunications. The flaw affects both Community Edition and Enterprise Edition, meaning organizations of all sizes are potentially at risk.

This is also the second critical GitLab vulnerability in recent weeks. The previous GraphQL code injection flaw, CVE-2026-19478, was almost immediately actively exploited. That pattern suggests attackers are paying close attention to GitLab and are quick to weaponize new flaws. Since November 2021, CISA has flagged four GitLab vulnerabilities as exploited in attacks, including two (CVE-2021-22175 and CVE-2021-39935) in February of this year. The recurrence points to a persistent targeting of developer infrastructure.

The software supply chain implications are serious. Developer platforms like GitLab often store the keys to an organization's cloud infrastructure, build systems, and deployment pipelines. A successful compromise can allow attackers to move from a single server into production environments, steal source code, and tamper with software before it reaches customers. That is why CISA's KEV listing and the short remediation deadline matter beyond federal agencies. Private organizations are encouraged to adopt the same urgency.

Next Up

Organizations running self managed GitLab instances should patch immediately to version 19.1.8, 19.2.6, or 19.3.2. Defenders should also hunt for signs of exploitation by reviewing GitLab and web server logs for unusual unauthenticated requests to repository commits API endpoints, unexpected file path parameters, traversal sequences, and anomalous response sizes. GBHackers advised rotating potentially exposed personal access tokens, deploy tokens, CI/CD variables, SSH keys, and cloud access secrets after remediation. CISA has not indicated whether CVE-2026-85706 is being used in ransomware campaigns.

watchTowr's guidance remains relevant: look for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.Path' parameters. As attackers continue to scan for vulnerable servers, the window to act without incident is closing. The next few days will reveal whether the probes observed on September 11 translate into widespread exploitation.