The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a significant vulnerability in GitLab, identified as CVE-2026-85706. This issue has been incorporated into the agency’s Known Exploited Vulnerabilities catalog, indicating active exploitation by threat actors.
GitLab Vulnerability Details
The vulnerability impacts both the Community Edition and Enterprise Edition of GitLab, carrying a critical severity score of 10.0 on the CVSS scale. It is a path traversal flaw within GitLab’s repository commits API, which under certain circumstances, can be exploited by unauthenticated attackers to read arbitrary files from a compromised server.
Path traversal vulnerabilities occur when an application inadequately restricts file paths, allowing attackers to navigate beyond the intended directory structure. This particular flaw is especially concerning due to its lack of need for user credentials or interaction, significantly lowering the barriers for potential exploitation.
Affected Versions and Recommendations
This vulnerability affects GitLab CE/EE versions 18.7 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1. Organizations using self-managed GitLab instances are advised to promptly identify exposed systems and upgrade to versions 19.1.8, 19.2.6, 19.3.2, or a later supported release based on their deployment.
CISA has set a deadline of September 14, 2026, for federal civilian executive branch agencies to remediate the issue, following its addition to the KEV catalog on September 11, 2026. The agency has highlighted the need for forensic triage under Binding Operational Directive 26-04, as systems may have been compromised prior to patching.
Security Implications and Actions
While there is no confirmed ransomware activity linked to this vulnerability, GitLab servers are attractive targets due to their ability to store sensitive data such as proprietary source code and deployment scripts. The exploitation of this flaw could lead to the exposure of credentials, configuration details, and other critical information, facilitating further intrusion activities.
Security teams are urged to prioritize patching GitLab systems that are accessible from the internet, scrutinize logs for unusual activities related to the repository commits API, and rotate potentially compromised credentials and secrets. GitLab acknowledged security researcher s3ntago for reporting the vulnerability via its HackerOne bug bounty program, linking it to CWE-35, which involves improper restriction of pathname accesses.
Ensuring timely updates and vigilant monitoring is crucial to safeguarding systems against these vulnerabilities and preventing unauthorized access to sensitive data.
