GitLab has issued updates to fix several security vulnerabilities, including a critical flaw that has been targeted by attackers shortly after its disclosure. The flaw, identified as CVE-2026-85706, has a CVSS score of 10.0, indicating its potential severity. This path traversal vulnerability in the repository commits API could permit unauthorized users to access arbitrary files on the GitLab server under specific conditions.
Details of the Vulnerability
The issue arises from improper path restriction and the lack of authentication enforcement in the API. It affects various versions of GitLab Community Edition (CE) and Enterprise Edition (EE). Specifically, all versions from 18.7 up to but not including 19.1.8, 19.2 up to 19.2.6, and 19.3 up to 19.3.2 are vulnerable.
According to watchTowr, a company specializing in exposure management, active exploitation of this vulnerability started at 06:00 UTC on September 11, 2026. Attackers could use this flaw to read log files and configuration files, potentially gaining access to credentials and sensitive data.
Threat Landscape and Implications
Jake Knott, head of threat intelligence at watchTowr, highlighted that this is the second severe GitLab vulnerability in recent weeks. The previous one involved a GraphQL code injection (CVE-2026-19478) that was also rapidly exploited. The current vulnerability allows attackers to access source code, CI/CD secrets, and inject code into build pipelines, posing significant risks.
The allure of exploiting GitLab lies in the unauthorized access it provides, which can lead to further malicious activities in downstream systems. As seen throughout the year, attackers have increasingly targeted such vulnerabilities to gain deeper access to IT infrastructures.
Mitigation and Recommendations
In response, GitLab has also addressed another critical issue in versions 19.3.2, 19.2.6, and 19.1.8. This insecure deserialization flaw (CVE-2026-87719, CVSS score: 9.9) could expose sensitive information if exploited by an authenticated user.
Organizations operating self-managed GitLab instances should urgently apply these patches to prevent unauthorized access. If immediate patching is not feasible, limiting public access is recommended. Knott advises monitoring log files for suspicious HTTP POST requests to the repository commits API to detect potential exploitation attempts.
Given the rapid transition of these vulnerabilities to widespread exploitation, timely action is crucial to safeguard against potential security breaches. Organizations are urged to prioritize these patches to protect their data and systems effectively.
