GitLab Patches Critical File-Read Flaw Under Active Attack
A newly disclosed path traversal vulnerability in GitLab is being actively exploited just hours after public release. Organizations should patch immediately to prevent unauthorized file access.
TL;DR
- CVE-2026-85706 is a CVSS 10.0 path traversal flaw in GitLab's repository commits API
- Attackers can read arbitrary files without authentication
- Exploitation attempts began within hours of public disclosure
- GitLab has released patches - immediate update recommended
- Organizations using GitLab should audit logs for suspicious activity
GitLab administrators are facing urgent patching requirements following the disclosure of a critical path traversal vulnerability. CVE-2026-85706 carries the maximum CVSS score of 10.0 and affects GitLab's repository commits API, enabling attackers to read sensitive files from affected servers without authentication.
Security teams monitoring web application threats have observed active exploitation attempts beginning almost immediately after the vulnerability was made public. The rapid weaponization underscores the importance of swift patch deployment in enterprise environments where GitLab instances may contain sensitive source code and infrastructure configurations.
Vulnerability Details
- CVE-2026-85706 affects GitLab's repository commits API endpoint
- The path traversal flaw allows reading of arbitrary server files without authentication
- Attackers can potentially access configuration files, credentials, and source code repositories
- All GitLab versions prior to the patched releases are potentially vulnerable
- No user interaction or special permissions required for exploitation
Immediate Actions Required
- Apply GitLab security patches immediately to all affected instances
- Review GitLab server logs for unauthorized file access patterns
- Monitor network traffic for suspicious API endpoint usage
- Consider temporary network segmentation for unpatched systems
- Audit exposed GitLab instances for signs of compromise or data exfiltration
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.