GitLab's CVSS 10 Flaw Was Under Attack Within Hours of Disclosure

GitLab just patched a flaw with a maximum CVSS score of 10.0. Worse, attackers started probing for it within hours of public disclosure.

Where the bug lives

CVE-2026-85706 is a path traversal issue in GitLab's repository commits API. GitLab's own advisory blames "improper path confinement and missing authentication enforcement" — the API neither restricted which files could be read nor bothered checking who was asking.

The result: an attacker with no account can read arbitrary files off a GitLab server, as long as the instance has at least one public project. That's not a rare setup — plenty of organizations keep a handful of repos public for docs or showcase purposes.

The bug hits both Community Edition (CE) and Enterprise Edition (EE), starting at version 18.7. Three branches are affected: 18.7 through before 19.1.8, 19.2 through before 19.2.6, and 19.3 through before 19.3.2. GitLab shipped fixes — 19.1.8, 19.2.6, 19.3.2 — on September 10, 2026. A researcher going by s3ntago reported it through GitLab's HackerOne bug bounty program.

Disclosure to exploitation: under a day

This is the part that should worry security teams. According to watchTowr, a firm that tracks real-world exploitation, probes targeting CVE-2026-85706 started around 06:00 UTC on September 11, 2026 — roughly a day after the patch went public.

Jake Knott, watchTowr's head of threat intelligence, called it "the second instance of a critical severity GitLab vulnerability in recent weeks," following CVE-2026-19478, a GraphQL code injection bug that was also exploited almost immediately after disclosure. Per Knott, attackers who exploit the flaw successfully target log files and GitLab-specific config files to grab credentials and secrets — the kind of access that opens the door to source code theft and, further downstream, supply-chain attacks against anything built on that GitLab instance.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation and added CVE-2026-85706 to its KEV catalog on September 11, 2026. Federal Civilian Executive Branch agencies now have until September 14, 2026 — three days after disclosure — to patch.

It's not the only one

The same patch round also fixed CVE-2026-87719, an insecure deserialization bug in the GraphQL subscription serializer, affecting EE only, CVSS 9.9. It lets an authenticated user with Duo Chat access craft a specially built GraphQL subscription argument to bypass serialization and pull Advanced Search configuration and sensitive credentials. Nearly as severe as the headline flaw — it just needs a valid account first.

The release also bundles more than a dozen other CVEs at High, Medium, and Low severity, spanning everything from CI/CD variable scope bypasses to a buffer overflow in Advanced Search indexing. For a platform that sits at the center of the CI/CD pipeline for hundreds of thousands of organizations, a bug like this isn't just "one more CVE number" — it's a door into source code, secrets, and the build pipeline itself.

What to know

• Patch immediately if self-hosting: upgrade to 19.3.2, 19.2.6, or 19.1.8 depending on your branch
• GitLab.com is already patched — only self-managed instances need action
• Check your logs: look for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ with unusual file.Path parameters — a sign of probing or exploitation
• Can't patch right away? restrict public access to the instance, or temporarily hide public projects if feasible
• Review the full patch list — several other CVEs (CI/CD variable scope, SAML SSO bypass) matter too if your team leans on EE features

A day from disclosure to active exploitation is a reminder: with CI/CD infrastructure exposed to the internet, "patch later" isn't a real option anymore.

---

Content assisted by AI (Amy 🌸). Reviewed by the author.