GitLab CVSS 10.0 Flaw Exploited in the Wild

Executive Summary

GitLab has issued an urgent advisory for users of self-managed Community Edition (CE) and Enterprise Edition (EE) instances to immediately patch a critical path traversal vulnerability, CVE-2026-85706. The flaw has been assigned the maximum possible CVSS score of 10.0, reflecting its severity and ease of exploitation. An unauthenticated attacker can exploit this vulnerability with a single HTTP request to read arbitrary files from the server, potentially exposing sensitive data like CI/CD secrets, source code, and user credentials. Within 24 hours of the patch release on September 10, 2026, security researchers at watchTowr observed active scanning and exploitation in the wild. In response, CISA has added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the imminent threat to all unpatched instances.

Vulnerability Details

CVE-2026-85706 is a path traversal vulnerability located in the repository commits API endpoint. The flaw arises from a combination of two weaknesses: improper path confinement and a lack of authentication enforcement for a specific API function.

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• CVSS 3.1 Score: 10.0 (Critical)

An attacker does not need an account on the GitLab instance to exploit this flaw. The only prerequisite is that the target instance must have at least one public project. The attacker can craft a malicious HTTP request to the commits API, using path traversal sequences (../) to navigate outside the intended directory and access any file on the server's filesystem that the GitLab user account can read.

Affected Systems

The vulnerability affects a wide range of self-managed GitLab CE and EE versions:

• 18.7 up to (but not including) 19.1.8
• 19.2 up to (but not including) 19.2.6
• 19.3 up to (but not including) 19.3.2

GitLab.com and other GitLab-managed instances are not affected. The issue is specific to customer-hosted environments.

Exploitation Status

Active exploitation is confirmed. Security firm watchTowr reported observing scanning and probing for this vulnerability starting at 06:00 UTC on September 11, 2026, just one day after patches were made public. This rapid weaponization indicates that exploit code is readily available, and automated, widespread attacks are underway or imminent. CISA's addition of the flaw to the KEV catalog, with a patching deadline of September 14, 2026, for federal agencies, further validates the active threat.

Impact Assessment

Successful exploitation of CVE-2026-85706 can have catastrophic consequences for an organization. By reading arbitrary files, an attacker can gain access to:

• Sensitive Credentials: gitlab.rb and gitlab-secrets.json files containing database credentials, secret keys, and other sensitive configuration data.
• CI/CD Variables and Secrets: Access tokens for cloud providers (AWS, GCP, Azure), package registries, and other integrated services.
• Private Source Code: Intellectual property, proprietary algorithms, and application source code stored in private repositories.
• User Data: User session tokens or other personally identifiable information (PII).

Possession of these secrets would allow an attacker to pivot, compromise connected cloud environments, poison the software supply chain by injecting malicious code, and gain persistent access to the organization's infrastructure.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

1. Log Analysis: Scrutinize web server logs (nginx/gitlab_access.log) for HTTP requests to the repository commits API endpoint that contain path traversal patterns. A sample log entry might look like: GET /api/v4/projects/1/repository/commits?path=../../../../../../../../../../etc/passwd
2. Web Application Firewall (WAF): Deploy a WAF with rules specifically designed to detect and block path traversal attacks. Many commercial WAFs have signatures for this type of activity.
3. Vulnerability Scanning: Use a vulnerability scanner with up-to-date plugins to actively scan your GitLab instances for CVE-2026-85706.

Remediation Steps

1. Patch Immediately: This is the most critical action. Upgrade all self-managed GitLab instances to the patched versions:
   • 19.1.8
   • 19.2.6
   • 19.3.2
2. Restrict Access: If immediate patching is impossible, restrict access to the GitLab instance at the network level. Allow connections only from trusted IP addresses and block all other external access until the patch can be applied.
3. Assume Compromise and Rotate Secrets: Due to the active exploitation, if your instance was exposed and unpatched, you should assume it has been compromised. Initiate a full secrets rotation procedure. This includes changing all secrets in gitlab.rb/gitlab-secrets.json, database credentials, CI/CD variables, and any tokens or keys stored within GitLab.