Ethical Hacking News
GitLab has been hit with a critical security vulnerability that is already being actively exploited by attackers, allowing unauthorized access to sensitive information and code. The CVE-2026-85706 path traversal issue has a CVSS score of 10.0 and impacts various versions of GitLab Community Edition (CE) and Enterprise Edition (EE). Organizations running self-managed GitLab instances exposed to the internet must apply the patches as soon as possible to prevent potential exploitation.
GitLab has been hit with a critical security vulnerability (CVE-2026-85706) with a CVSS score of 10.0, allowing unauthenticated users to read arbitrary files. The vulnerability impacts various versions of GitLab Community Edition and Enterprise Edition, with multiple affected versions. The vulnerability allows attackers to read log files, GitLab-specific configuration files, and obtain credentials and sensitive information. Organizations running self-managed GitLab instances exposed to the internet must apply patches or limit public access as soon as possible. GitLab has also patched a critical insecure deserialization bug (CVE-2026-87719) that could result in information disclosure. Defenders have limited time to act, and organizations should review log files for potential exploitation attempts.
GitLab, a prominent web-based platform for software development and collaboration, has recently been hit with a critical security vulnerability that is already being actively exploited by attackers. The CVE-2026-85706, a path traversal issue in the repository commits API, has a CVSS score of 10.0, indicating that it is considered a maximum-severity vulnerability. This flaw allows an unauthenticated user to read arbitrary files from the GitLab server under certain conditions, posing a significant risk to the security and integrity of the platform.
The problem, according to GitLab, stems from "improper path confinement and missing authentication enforcement in the repository commits API." This vulnerability impacts various versions of GitLab Community Edition (CE) and Enterprise Edition (EE), with all versions from 18.7 before 19.1.8, all versions from 19.2 before 19.2.6, and all versions from 19.3 before 19.3.2 being affected.
WatchTowr, a preemptive exposure management firm, has noted that the vulnerability is already witnessing active in-the-wild probes since 06:00 UTC on September 11, 2026. The issue allows an external attacker to read log files and GitLab-specific configuration files to obtain credentials, secrets, and sensitive information. According to Jake Knott, head of threat intelligence at watchTowr, this is the second instance of a critical severity GitLab vulnerability in recent weeks, following the previous GraphQL code injection (CVE-2026-19478) that was almost immediately actively exploited.
The appeal to attackers of GitLab is obvious, as unauthorized access allows an attacker to gain access to source code, CI/CD secrets, credentials, and the ability to inject code into build pipelines, gaining access or poisoning anything downstream of it, which as we've seen throughout this year has been a favorite of attackers. Organizations running self-managed GitLab instances that are exposed to the internet must apply the patches as soon as possible, or limit public access, if not required.
In addition to this critical vulnerability, GitLab has also patched a critical insecure deserialization bug in GitLab EE (CVE-2026-87719, CVSS score: 9.9) that could result in information disclosure. The vulnerability could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.
GitLab has released patches to address multiple flaws, including the maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure. The patches have been released for the affected versions of GitLab Community Edition (CE) and Enterprise Edition (EE), which includes all versions from 18.7 before 19.1.8, all versions from 19.2 before 19.2.6, and all versions from 19.3 before 19.3.2.
Jake Knott, head of threat intelligence at watchTowr, warned that the transition of this vulnerability to indiscriminate mass exploitation is likely not far away, and defenders have limited time to act. He also advised that organizations should review log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.Path' parameters to identify potential exploitation attempts.
In conclusion, the recent critical security vulnerability in GitLab is a serious concern that highlights the importance of timely patching and vigilance in the face of emerging threats. As the threat landscape continues to evolve, it is essential for organizations to stay informed and take proactive measures to protect themselves against such vulnerabilities.
Related Information:
https://www.ethicalhackingnews.com/articles/GitLabs-Critical-File-Read-Flaw-A-Prime-Target-for-Attackers-as-In-the-Wild-Probes-Surge-ehn.shtml
https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html
https://nvd.nist.gov/vuln/detail/CVE-2026-85706
https://www.cvedetails.com/cve/CVE-2026-85706/
https://nvd.nist.gov/vuln/detail/CVE-2026-19478
https://www.cvedetails.com/cve/CVE-2026-19478/
https://nvd.nist.gov/vuln/detail/CVE-2026-87719
https://www.cvedetails.com/cve/CVE-2026-87719/
Published: Fri Sep 11 13:33:50 2026 by llama3.2 3B Q4_K_M
