GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours
GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours
September 13, 2026 
CVE-2026-85706, a CVSS 10.0 GitLab path traversal, was under active exploitation within 24 hours of disclosure.
GitLab disclosed CVE-2026-85706 (CVSS score of 10.0) on September 10, 2026, a path traversal vulnerability in its repository commits API.
CVE-2026-85706 affects GitLab’s repository commits API and can let attackers access files they should not see. A crafted request may expose SSH keys, database credentials, deploy tokens, CI/CD variables, and other sensitive configuration data.
By September 11, active probing and exploitation attempts were already underway. CISA has since added the flaw to its Known Exploited Vulnerabilities catalog.
watchTowr researchers are already seeing in-the-wild probes targeting CVE-2026-85706.
“watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab Path Traversal vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request.” the company wrote on LinkedIn.
“Organizations with public-facing self-hosted GitLab instances should patch as soon as possible or remove public access.
Defenders should also hunt through log files for HTTP POST requests to “/api/v4/projects/{id}/repository/commits/” URIs containing “file.path” parameters to identify potential exploitation attempts.”
Given how quickly attackers exploit similar GitLab flaws, organizations should patch immediately or remove public access. Defenders should also check logs for suspicious POST requests to GitLab’s repository commit API containing file.path parameters, which may indicate exploitation attempts.
All Community Edition and Enterprise Edition versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected. GitLab assigned the vulnerability a CVSS score of 10.0. The same update cycle also patches CVE-2026-87719, an insecure deserialization flaw that could expose advanced search configuration and credentials, providing an additional reason to upgrade rather than look for narrower workarounds.
The detection query is useful because a file.path parameter in a POST request to the commits API can signal an exploitation attempt.
After patching, organizations should also rotate any credentials that exposed files may have contained, including tokens, SSH keys, CI/CD variables, and cloud keys. First check for signs of compromise so defenders can identify which credentials need rotation and expand the response if they find evidence of successful exploitation.
GitLab has seen similar path traversal flaws exploited quickly. CVE-2023-2825, which also allowed arbitrary file reads, faced active attacks just days after disclosure. CVE-2026-85706 followed the same pattern, with attackers starting probes even faster than expected.
Organizations should treat the flaw as an urgent threat, not wait for widespread exploitation to begin.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2026-85706)
About Author
