GitLab's Critical 10.0 CVSS Flaw Sparks Immediate Exploitation Attempts
Unauthenticated file-read vulnerability actively probed within hours of disclosure.
1Critical Vulnerability Details
GitLab disclosed CVE-2026-85706, a maximum-severity (CVSS 10.0) path traversal flaw in its repository commits API. The vulnerability allows unauthenticated attackers to read arbitrary files from GitLab servers under specific conditions. This stems from improper path confinement and missing authentication enforcement in the API. Affected versions include GitLab Community and Enterprise Editions. The flaw enables access to sensitive configuration files containing credentials and secrets.
2Immediate Exploitation Activity
Within hours of public disclosure on September 11, 2026, security firm watchTowr observed active in-the-wild probes targeting the vulnerability. Attackers are exploiting the flaw to access log files and GitLab-specific configurations. This marks the second critical GitLab vulnerability in recent weeks, following CVE-2026-19478 which was almost immediately exploited. The current attack requires only one condition: the existence of at least one public project on the target instance.
3Attackers' Motivations
GitLab's appeal to attackers lies in its treasure trove of sensitive data. Successful exploitation provides access to source code, CI/CD secrets, and credentials. More dangerously, it enables code injection into build pipelines, potentially compromising downstream systems. This pattern aligns with 2026's attacker trends, where supply chain poisoning through development tools has become increasingly common. The vulnerability's ease of exploitation makes it particularly dangerous.
4Additional Patched Vulnerabilities
GitLab simultaneously addressed CVE-2026-87719, a critical 9.9 CVSS insecure deserialization bug in Enterprise Edition. This flaw allows authenticated users with Duo Chat access to bypass serialization via crafted GraphQL subscriptions, potentially exposing Advanced Search configurations and credentials. The patches (versions 19.3.2, 19.2.6, and 19.1.8) address both vulnerabilities, with the file-read flaw being the more immediately dangerous due to its unauthenticated nature.
5Urgent Mitigation Requirements
Organizations must immediately patch exposed self-managed GitLab instances or restrict public access. Historical patterns suggest rapid escalation to mass exploitation is likely. Security teams should monitor '/api/v4/projects/{id}/repository/commits/' URIs for suspicious POST requests containing 'file.Path' parameters. watchTowr's threat intelligence head Jake Knott warns defenders have limited time before widespread attacks commence.
6Broader Security Implications
This incident highlights the growing sophistication of attacks targeting development infrastructure. The consecutive critical vulnerabilities in GitLab demonstrate how CI/CD systems have become prime targets. Attackers increasingly focus on poisoning software supply chains through development tools. The rapid weaponization of disclosed flaws underscores the shrinking window for defensive action in modern cybersecurity landscapes.
7Detection and Prevention Strategies
Beyond patching, organizations should implement robust monitoring for unusual file access patterns. Security teams need capabilities to test new CVEs against their specific environments, confirming actual exploitability. Prioritization frameworks should focus on vulnerabilities offering access to sensitive systems or enabling lateral movement. The accelerating threat landscape demands proactive exposure management before AI-powered attacks become mainstream.
8Industry-Wide Impact
GitLab's widespread adoption in software development makes this vulnerability particularly consequential. With many organizations relying on GitLab for version control and CI/CD, successful exploits could compromise numerous software supply chains. The tech industry must reassess security practices around development tools, emphasizing faster patch cycles and stricter access controls. This event serves as another wake-up call for development infrastructure security.