GitLab patched CVE-2026-85706 on 10 September 2026. It scores 10.0, which is rare and, in this case, straightforward to justify: no authentication, low attack complexity, and the ability to read arbitrary files from the server.

By the following day, watchTowr was seeing exploitation attempts against its honeypot network. On 11 September CISA added it to the Known Exploited Vulnerabilities catalog with a federal deadline of 14 September.

Two failures in one endpoint

watchTowr's description of the root cause is worth reading closely: "improper path confinement combined with missing authentication enforcement in the affected API endpoint."

Those are two separate mistakes, and either alone would have been much less serious.

A path traversal bug behind authentication is a privilege problem — bad, but it needs an account. A missing authentication check on an endpoint that only returns commit metadata is a disclosure problem — bad, but bounded. Together, on an endpoint that resolves file paths, they produce the worst case: anyone who can reach the server can ask it for files.

The request goes to the projects repository commits endpoint under the version 4 API, carrying a file path parameter. GitLab's own advisory language notes the read works under certain conditions, which is the caveat to keep in mind when reading exploitation claims — not every instance and not every request.

What is actually on a GitLab server

This is why a file-read bug on this particular product is not a small thing. watchTowr lists what an attacker could reach: "configuration files, secrets, or other sensitive server-side data", including "source code, credentials, and CI/CD configuration data."

A self-hosted GitLab is usually the place an organisation keeps the instructions for building and deploying everything it runs, along with the credentials those instructions use. Reading arbitrary files there is rarely the end of the intrusion. It is the part where the attacker collects the keys for the next one.

Patched Thursday, attacked Friday

The timing is the part worth internalising.

GitLab shipped fixes on the Thursday. Attackers reproduced the flaw and began probing on the Friday. watchTowr noted that attackers "have already successfully reverse engineered and reproduced the vulnerability".

For a widely deployed product, a security release is a specification. It says which file changed, and the change says what used to be possible. The window between a patch being available and a patch being understood by strangers is now measured in hours, which means the operational question is not whether you will patch but whether you can patch faster than someone reads the diff.

That is also why this one landed on a three-day federal clock rather than a longer one. As with the Cisco firewall manager this week, the deadline follows exposure and automatability rather than the score alone — and an internet-reachable code host with a one-request exploit scores badly on both.

Versions

Affected: all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, in both Community and Enterprise editions.

Fixed in 19.1.8, 19.2.6 and 19.3.2.

What to do

  • Upgrade now to one of the three fixed releases. There is no configuration workaround for a missing authentication check.
  • If your instance was internet-reachable before you patched, treat its secrets as disclosed. Rotate CI/CD variables, deploy tokens, runner registration tokens and any credential stored in the configuration.
  • Search your logs for requests to the commits endpoint carrying path parameters, particularly from unauthenticated sources.
  • Ask why it was internet-reachable at all. Most self-hosted code servers do not need to be.
  • Do not treat a honeypot probe as proof you were spared. Probes indicate a working exploit in circulation, not the limit of its use.

What is not established

  • Whether any real instance has been breached. What has been reported is exploitation attempts and successful reproduction.
  • The exact conditions under which the read succeeds. Both GitLab and watchTowr qualify it.
  • How many exposed instances remain unpatched.
  • Who is scanning. No attribution has been published.