GitLab CVSS 10 File-Read Flaw Exploited One Day After Patch Disclosure

September 11, 2026 at 09:11 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Threat actors began exploiting a newly patched critical vulnerability in GitLab one day after public disclosure, attack surface management firm WatchTowr reported. The flaw, CVE-2026-85706, allows unauthenticated attackers to read arbitrary files from GitLab servers. WatchTowr observed in-the-wild probes starting at 06:00 UTC on September 11, 2026, and warned that mass exploitation is likely to follow.

Key Facts

CVE-2026-85706 is a path traversal vulnerability in the GitLab repository commits API with a CVSS score of 10.0, allowing unauthenticated users to read arbitrary files from the server.
WatchTowr observed in-the-wild exploitation probes for CVE-2026-85706 starting at 06:00 UTC on September 11, 2026, one day after GitLab released patches.
Affected versions include all GitLab Community Edition and Enterprise Edition releases from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.
The patches also resolve 17 other vulnerabilities, including CVE-2026-87719, a critical-severity insecure deserialization flaw with a CVSS score of 9.9.
WatchTowr advises defenders to search logs for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters to detect exploitation attempts.

Vulnerability Details

CVE-2026-85706 is a path traversal issue in the repository commits API that allows an unauthenticated user to read arbitrary files from the GitLab server under certain conditions. GitLab attributed the flaw to improper path confinement and missing authentication enforcement in the repository commits API. The vulnerability affects all GitLab Community Edition and Enterprise Edition versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. An attacker exploiting the flaw can read log files and GitLab-specific configuration files to obtain credentials, secrets, and sensitive information.

Exploitation Activity

WatchTowr observed the first in-the-wild exploitation attempts targeting CVE-2026-85706 on Friday, one day after GitLab announced patches. The company reported active in-the-wild probes since 06:00 UTC on September 11, 2026. WatchTowr stated that the vulnerability allows attackers to read arbitrary files in a single HTTP request. Jake Knott, head of threat intelligence at WatchTowr, noted that this is the second critical GitLab vulnerability in recent weeks to be almost immediately exploited, following CVE-2026-19478. WatchTowr warned that mass exploitation of CVE-2026-85706 is likely to follow shortly.

Mitigation Guidance

GitLab released patches in versions 19.1.8, 19.2.6, and 19.3.2 that resolve CVE-2026-85706 and 17 other vulnerabilities. The patches also address CVE-2026-87719, a critical-severity insecure deserialization flaw in the GraphQL subscription serializer with a CVSS score of 9.9. Six high-severity security defects fixed in the same releases could allow remote code execution, access to protected CI/CD variables, XSS attacks, and denial-of-service conditions. WatchTowr recommends that defenders hunt through log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters to identify potential exploitation attempts. Self-hosted GitLab instances should be upgraded as soon as possible to the patched versions.