Ethical Hacking News
GitLab CVE-2026-85706 is a high-severity vulnerability that allows attackers to access sensitive files via a single HTTP request. Organizations must take immediate action to patch this vulnerability and protect themselves against potential exploitation. This article provides an in-depth analysis of the vulnerability and its implications for organizations.
High-severity vulnerabilities are emerging, posing significant threats to organizations and individuals. The GitLab CVE-2026-85706 vulnerability allows attackers to access sensitive files without authentication. The vulnerability, classified under CVSS 10.0, was disclosed on September 10, 2026, and is being actively exploited. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, highlighting its severity. Organizations must patch the vulnerability immediately, remove public access, and rotate exposed credentials.
The cybersecurity landscape has witnessed the emergence of high-severity vulnerabilities that pose significant threats to organizations and individuals alike. Among these, the recent discovery of the GitLab CVE-2026-85706 vulnerability stands out due to its severity and the manner in which it can be exploited. This vulnerability, classified under the CVSS 10.0 scale, allows attackers to access sensitive files by sending a single HTTP request without authentication. The alarming rate at which attackers have begun exploiting this vulnerability, with active probing and exploitation attempts already underway, underscores the imperative for organizations to take swift action to mitigate this threat.
GitLab disclosed the CVE-2026-85706 vulnerability on September 10, 2026, revealing a path traversal vulnerability in its repository commits API. This vulnerability allows attackers to access files they should not see, potentially exposing sensitive configuration data such as SSH keys, database credentials, deploy tokens, CI/CD variables, and other critical information. The speed at which attackers began probing and exploiting the vulnerability, with instances of active exploitation observed within 24 hours of its disclosure, highlights the urgency with which organizations must address this issue.
CISA has since added the vulnerability to its Known Exploited Vulnerabilities catalog, underscoring the severity of the threat it poses. The fact that attackers are already targeting this vulnerability in-the-wild, as observed by Intel and watchTowr, underscores the critical nature of this vulnerability and the need for swift action to mitigate it. The recent experience of similar GitLab vulnerabilities, such as CVE-2023-2825, where similar path traversal flaws were exploited quickly, serves as a grim reminder of the importance of vigilance in addressing such vulnerabilities.
Given the high severity of the CVE-2026-85706 vulnerability and the alarming rate at which it is being exploited, it is imperative for organizations to take immediate action to patch this vulnerability. Organizations with public-facing self-hosted GitLab instances should patch as soon as possible or remove public access to prevent exploitation. Defenders should also hunt through log files for HTTP POST requests to "/api/v4/projects/{id}/repository/commits/" URIs containing "file.path" parameters to identify potential exploitation attempts. After patching, organizations should also rotate any credentials that exposed files may have contained, including tokens, SSH keys, CI/CD variables, and cloud keys.
In conclusion, the discovery of the GitLab CVE-2026-85706 vulnerability serves as a stark reminder of the importance of cybersecurity vigilance and proactive measures to mitigate threats. As attackers continue to exploit this vulnerability, it is essential for organizations to take immediate action to patch this vulnerability and protect themselves against potential exploitation. The recent surge in high-severity vulnerabilities underscores the need for organizations to maintain a proactive stance in addressing cybersecurity threats.
Related Information:
https://www.ethicalhackingnews.com/articles/GitLab-CVE-2026-85706-A-High-Severity-Vulnerability-Allows-Remote-File-Access-via-Single-HTTP-Request-ehn.shtml
https://securityaffairs.com/198945/hacking/gitlab-cve-2026-85706-one-http-request-no-authentication-full-file-read-exploited-within-24-hours.html
https://nvd.nist.gov/vuln/detail/CVE-2026-85706
https://www.cvedetails.com/cve/CVE-2026-85706/
Published: Sun Sep 13 07:48:13 2026 by llama3.2 3B Q4_K_M
