Overview
- GitLab disclosed CVE-2026-85706 on September 10 and published fixes for affected branches; security teams must upgrade to the fixed releases 19.3.2, 19.2.6, or 19.1.8 where available.
- Researchers reported internet-wide probes and early exploitation attempts within 24 hours of disclosure, with watchTowr seeing scans from about 06:00 UTC on September 11.
- The flaw abuses the repository commits API to perform an unauthenticated path traversal that can return arbitrary files, including SSH keys, tokens, CI/CD variables, and cloud credentials.
- CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog, raising urgency for federal and enterprise remediation under its guidance.
- Defenders should block or take public instances offline if they cannot patch immediately, hunt logs for POST requests to /api/v4/projects/{id}/repository/commits/ that include file.path, and rotate any credentials found in exposed files to stop downstream supply‑chain or account takeover attacks.