GitLab scored a perfect 10 on the vulnerability scale and attackers noticed

One request, no password, every file on the server

CVE-2026-85706 is a path traversal vulnerability in the GitLab repository commits API. It scores a maximum 10.0 on the CVSS severity scale, which tells its own story. A single unauthenticated HTTP request can read any file on a GitLab server, including credentials, secrets, SSH keys, and configuration data.

GitLab published patches on September 10. Within 24 hours, security firm WatchTowr observed exploitation attempts in the wild. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 11, which means US federal agencies are now required to patch.

What is affected

All GitLab Community Edition and Enterprise Edition versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are vulnerable. If your instance falls in that range and is reachable from the internet, assume someone has already tried.

The attack does not require authentication, does not require any special configuration, and works against default installations. That combination is why it scored a perfect 10.

Why this one is worse than most

GitLab is not a random web application. It hosts source code, CI/CD pipeline definitions, deployment keys, database credentials, and API tokens. An unauthenticated file read on a GitLab server is effectively a skeleton key to the entire software supply chain behind it.

If an attacker reads your `.env` files, your CI runner tokens, or your deploy keys, patching the GitLab vulnerability is only step one. You also need to rotate every secret that server ever held. That is the part that makes this expensive to fix, not the patch itself.

What to do right now

Patch to GitLab 19.1.8, 19.2.6, or 19.3.2 immediately. If you cannot patch within the hour, restrict network access to your GitLab instance as a temporary measure.

After patching, check your server logs for unusual requests to the commits API. Look specifically for path traversal patterns in URL parameters. GitLab has published indicators of compromise in their security advisory, and the pattern matches what we saw with Zimbra's recent exploit chain.

Then rotate your secrets. Every SSH key, API token, database password, and CI/CD variable stored on that server should be treated as compromised until proven otherwise. A YubiKey on your admin accounts will not fix this particular flaw, but it stops the credential replay attacks that typically follow a breach like this.

The part worth sitting with: the patch was public for less than a day before exploitation started. The window between disclosure and attack is now measured in hours, not weeks. If your patching workflow runs on a weekly cycle, this is the kind of vulnerability that punishes that schedule.

Some links in this article are affiliate links. We may earn a small commission at no extra cost to you.