- GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, addressing the critical path traversal vulnerability tracked as CVE-2026-85706, which has a CVSS score of 10.0.
- In-the-wild probes for CVE-2026-85706 were observed by watchTowr starting at 06:00 UTC on September 11, 2026.
- WatchTowr released targeted network-level mitigations to clients and advised organizations to apply patches or limit public access.
- The vulnerability CVE-2026-85706 is a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under certain conditions.
- The root cause of the issue is improper path confinement combined with missing authentication enforcement in the affected API endpoint.
- Organizations running self-managed GitLab instances that are exposed to the internet must apply the patches as soon as possible or limit public access.
- WatchTowr assesses with high confidence that this vulnerability will rapidly transition to indiscriminate, in-the-wild exploitation given the low complexity of exploitation.
GitLab has addressed a critical path traversal vulnerability (CVE-2026-85706) with a CVSS score of 10.0, affecting its repository commits API. This flaw allows unauthenticated users to read arbitrary files from the server, posing significant risks to sensitive data.1236
The vulnerability stems from improper path confinement and missing authentication enforcement, impacting all versions of GitLab Community Edition (CE) and Enterprise Edition (EE) from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. WatchTowr reported that probes for this vulnerability began on September 11, 2026, indicating active exploitation attempts.4579
According to Jake Knott, head of threat intelligence at WatchTowr, “This is the second instance of a critical severity GitLab vulnerability in recent weeks.” He emphasized that exploitation requires at least one public project to exist, making many organizations vulnerable.8
GitLab released patches on September 10, 2026, in versions 19.3.2, 19.2.6, and 19.1.8. Organizations are urged to apply these patches immediately or restrict public access to their self-hosted instances. Additionally, they should monitor log files for suspicious HTTP POST requests to identify potential exploitation attempts.
The urgency of this situation is underscored by the fact that WatchTowr has already observed behavioral probes against their global honeypot network, indicating that attackers are actively seeking to exploit this vulnerability.
“watchTowr observed active probes starting 06:00 UTC on September 11, 2026, and warns that mass exploitation is likely imminent. The flaw allows unauthenticated file reads, exposing credentials and CI/CD secrets, and also patches a critical deserialization bug (CVE-2026-87719) in GitLab EE.”
