Overview
- GitLab disclosed CVE-2026-85706 on September 10, 2026, and published patched CE/EE releases (notably 19.3.2, 19.2.6 and 19.1.8) that operators must install immediately.
- Threat intelligence firms observed active internet probes and exploitation attempts within about 24 hours after disclosure, with researchers reporting in-the-wild activity on September 11.
- CISA added the flaw to its KEV catalog and applied BOD 26-04 requirements, giving federal civilian agencies a compressed timetable to remediate and urging all organizations to prioritize fixes.
- The bug is an unauthenticated path traversal in the repository commits API that can return arbitrary files such as SSH keys, database credentials, deploy tokens and CI/CD variables.
- Security teams are advised to apply vendor patches or block public access, hunt logs for POST requests to /api/v4/projects/{id}/repository/commits/ with file.path parameters, perform forensic checks, and rotate any exposed credentials because rapid weaponization risks downstream supply-chain and account compromise.