Perfect-10 GitLab bug under attack days after patch lands

CISA says attackers are exploiting a maximum-severity GitLab flaw that lets unauthenticated miscreants read arbitrary files from vulnerable servers after the code shack released fixes on September 10. The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog. The vulnerability is a path traversal bug in the repository commits API affecting GitLab Community Edition and Enterprise Edition. GitLab rates it a perfect 10.0, the maximum score on the CVSS v3.1 severity scale. Under certain conditions, an attacker doesn't need to log in before abusing the flaw to read arbitrary files from the GitLab server. GitLab blamed the problem on improper path confinement combined with missing authentication enforcement in the affected API. That's not an especially comforting combination on a platform that can be stuffed with source code, configuration files, and credentials. GitLab shipped fixes on September 10 in versions 19.3.2, 19.2.6 and 19.1.8, and urged operators of affected self-managed installations to upgrade immediately. The bug affects versions from 18.7 before 19.1.8, the 19.2 branch before 19.2.6, and 19.3 before 19.3.2. GitLab.com is already patched, while GitLab Dedicated customers don't need to take action. Security outfit watchTowr said over the weekend that it was observing probes for CVE-2026-85706 in the wild. The firm warned that widespread exploitation was likely to follow quickly. According to watchTowr, exploiting the flaw can be as simple as sending a single HTTP request, potentially allowing an attacker to get at local files, configuration data, credentials and other secrets. The firm advised organizations running internet-facing self-hosted GitLab instances to patch them or pull them from public access. Admins investigating potential exploitation attempts should check logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ containing file.path parameters, watchTowr said. "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA said. "While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities." For exposed, unpatched installations, that upgrade belongs on today's to-do list. ®