CVE-2026-85706 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-12

Added to CISA KEV: 2026-09-11 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review GitLab API/access logs for anomalous requests to the repository commits API, path traversal patterns (e.g. ../ sequences), and unauthenticated file-read attempts. Assume secrets may be compromised.
IMMEDIATELY upgrade to GitLab 19.3.2, 19.2.6, or 19.1.8 (or later) - no workarounds exist. Prioritize internet-facing instances first.
Rotate all potentially exposed secrets: GitLab secret keys, database credentials, CI/CD variables, SSH host keys, tokens, and any credentials stored in configuration files or environment variables, as arbitrary file read may have exposed them.
Deploy WAF/detection rules to block path traversal payloads against the commits API and monitor for exploitation attempts; restrict internet exposure to only what is necessary.
Patch Priority: EMERGENCY / P0 - actively exploited, unauthenticated, CVSS 10.0, on CISA KEV.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-85706 is a critical-severity (CVSS 10.0) path traversal vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE) ^[1]^[6]. The flaw resides in the repository commits API, where improper path confinement and missing authentication enforcement allow unauthenticated, remote attackers to read arbitrary files from the underlying GitLab server ^[1]. This is a high-consequence vulnerability because it enables direct, unauthorized access to sensitive system files, including configuration files, credentials, and source code, potentially leading to a full system compromise.

Exploitation

Active Exploitation: The vulnerability is currently being actively exploited in the wild, with reports of malicious probing and exploitation beginning within 24 hours of public disclosure ^[2]^[5].
Threat Actors: It has been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog due to confirmed evidence of exploitation ^[4].
Exploit Availability: The flaw is trivial to exploit, requiring only a single, unauthenticated HTTP request ^[2].
Prerequisites:

- Network: Remote, network-accessible deployment. - Authentication: None required (unauthenticated). - User Interaction: None required.

Affected Products & Patches

Affected Versions: GitLab CE/EE versions 18.7 through 19.3.x (specifically including versions before 19.1.8, before 19.2.6, and 19.3.x) ^[7]^[8].
Patch Availability: Emergency patches have been released in versions 19.3.2, 19.2.6, and 19.1.8. Organizations are urged to upgrade immediately ^[1].
Mitigation: There are no widely recognized workarounds; immediate patching is the only recommended security response for self-managed instances ^[3].

Impact

System Access: Successful exploitation grants an attacker the ability to read arbitrary files from the GitLab server filesystem, bypass authentication, and bypass path restrictions ^[1].
Business Risk: For internet-facing deployments, this risk is extreme. Attackers can exfiltrate sensitive data such as application secrets, database credentials, environment variables, and proprietary source code, which can be leveraged to escalate privileges, gain full administrative control of the GitLab instance, or move laterally within the corporate network.

Sources

GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8
CVE-2026-85706 - Path Traversal issue in repository commits API impacts GitLab CE/EE. GitLab has remediated an issue that, under certain ... CVE-2026-85706 - Path Traversal issue in repository commits API impacts GitLab CE/EE GitLab has remediated an issue that, under certain conditions, an unauthen…
GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File ...
CVE-2026-85706, a CVSS 10.0 GitLab path traversal, was under active exploitation within 24 hours of disclosure.
CVE-2026-85706: GitLab Maximum-Severity Path Traversal — Detection ...
GitLab has issued an emergency patch for CVE-2026-85706, a max-severity path traversal flaw. Self-managed CE/EE instances are at risk — patch and hunt now.
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber…
GitLab Vulnerability Exploited One Day After Disclosure
Threat actors started exploiting CVE-2026-85706, a critical-severity path traversal in GitLab, one day after public disclosure.

🔴 CVE-2026-85706