GitLab CVE-2026-85706: CVSS 10 Path Traversal Exploited Within Hours of Disclosure
GitLab CVE-2026-85706: CVSS 10 Path Traversal Exploited Within Hours of Disclosure
A single HTTP POST request to GitLab's commits API is enough to read arbitrary files from a GitLab server — no authentication required, as long as the instance hosts at least one public project. The path traversal flaw, tracked as CVE-2026-85706 and scored a maximum 10.0 CVSS, was patched on September 10, 2026, and hit active exploitation within six hours. CISA added it to its Known Exploited Vulnerabilities catalog the next day, giving federal agencies a September 14 remediation deadline under BOD 26-04.
How It Works
The vulnerability sits in the /api/v4/projects/{id}/repository/commits/ endpoint, where a failure of path confinement combined with a lack of authentication enforcement lets a single crafted POST bypass security controls and traverse out of intended directories to read files anywhere on the server filesystem. It was reported by researcher s3ntago through the HackerOne bug bounty program. GitLab shipped fixes in versions 19.3.2, 19.2.6, and 19.1.8, covering self-managed CE/EE instances from 18.7 onward. GitLab.com itself is patched — but an estimated 20,000-plus self-managed instances worldwide remain exposed until their administrators act.
Weaponization at Record Speed
watchTowr's honeypot network observed exploitation attempts starting at 06:00 UTC on September 11 — six hours after the patch release. Compromising a GitLab instance is a high-value prize: as watchTowr's head of threat intelligence Jake Knott noted, unauthorized access exposes source code, CI/CD secrets and credentials, and the ability to inject code into build pipelines, poisoning everything downstream. This is also the second critical-severity GitLab vulnerability in recent weeks, after the GraphQL code injection flaw CVE-2026-19478 saw near-immediate active exploitation in August.
A Structural Pattern
CVE-2026-85706 is GitLab's second CVSS 10 path traversal in three years — the previous one, CVE-2023-2825 in the uploads endpoint, was patched in May 2023. Two maximum-severity path traversals on different API surfaces suggest a structural weakness in how untrusted file paths are handled platform-wide. The flaw shipped in a batch of 17 fixes that also includes CVE-2026-87719, a CVSS 9.9 insecure deserialization issue in the GraphQL subscription serializer that can expose Advanced Search configurations and credentials through Duo Chat; CVE-2026-88765, a buffer overflow in the Unicode conversion wrapper enabling remote code execution via crafted Git project exports; and CVE-2026-12910, a SAML SSO bypass allowing authenticated users to circumvent sign-in restrictions.
What Should You Do?
- Patch immediately. Upgrade self-managed instances to 19.3.2, 19.2.6, or 19.1.8 — before the September 14 CISA deadline, because attackers are already probing.
- Hunt for exploitation now. Look for HTTP POST requests to
/api/v4/projects/{id}/repository/commits/URIs containing file path parameters — the strongest indicator of probing or compromise. - Assume exposed secrets are compromised. If your instance was reachable during the exploitation window, rotate CI/CD tokens, deploy keys, and anything stored in repositories or pipelines.
- Reduce API exposure. Self-managed GitLab instances should not be internet-facing without a proxy layer that can filter and rate-limit API traffic.
The WAF Angle
Path traversal is one of the oldest, most signature-friendly attack classes — the sequences and encoded variants a WAF inspects for are well understood, and rules tuned to catch traversal payloads in API parameters would flag the crafted commit requests this exploit requires. A WAF in front of a self-managed GitLab also buys time: rate limiting and anomaly scoring on the REST API slow mass scanning while patching catches up. The harder truth is that a missing-authorization flaw is an application defect no edge policy fully repairs — which is why the WAF belongs in front of even internal dev platforms, watching for exactly the request shapes that shouldn't exist.
