Overview
- GitLab disclosed CVE-2026-85706 on September 10 and published patches in CE/EE builds 19.3.2, 19.2.6 and 19.1.x to fix an unauthenticated path traversal in the repository commits API.
- Security teams observed internet scanning within about 24 hours of the disclosure and researchers reported that probing escalated over the weekend to confirmed theft of sensitive files on some self-hosted instances.
- The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog and gave federal agencies a rapid remediation deadline to force fast fixes.
- Defenders are urged to apply the GitLab patches immediately or block public access, hunt logs for POST requests to /api/v4/projects/{id}/repository/commits/ that include a file.path parameter, and rotate any exposed keys or tokens.
- Because many companies run self-managed GitLab and store pipeline secrets there, stolen files can expose source code, allow lateral access to hosts, and let attackers tamper with CI/CD pipelines downstream.