GitLab Issues Critical Patch for Maximum-Severity Path Traversal Flaw as Attackers Begin Active Probing

GitLab has released emergency security updates to address a maximum-severity path traversal vulnerability tracked as CVE-2026-85706, which allows unauthenticated external actors to extract sensitive server-side files via the repository commits API. Cybersecurity researchers and threat intelligence teams reported in-the-wild reconnaissance activity targeting internet-facing, self-managed instances almost immediately after patch details became public on September 10, prompting rapid intervention from federal regulators and industry analysts.

The critical flaw carries a maximum CVSS score of 10.0 due to its lack of authentication requirements and minimal technical barrier to exploitation. According to disclosures from GitLab and security firm watchTowr, the vulnerability stems from missing authentication enforcement combined with improper path confinement in the repository commits endpoint. An unauthenticated attacker with access to at least one public project can submit crafted requests to retrieve internal configuration files, database credentials, SSH keys, and authentication tokens from vulnerable servers running Community Edition or Enterprise Edition versions 18.7 through 19.3.1.

The United States Cybersecurity and Infrastructure Security Agency responded to the disclosure by adding CVE-2026-85706 to its catalog of actively exploited vulnerabilities. Federal Civilian Executive Branch agencies were instructed under Binding Operational Directive 26-04 to secure their systems within a three-day remediation window. While the federal directive applies directly to government entities, CISA strongly encouraged private-sector network defenders to prioritize immediate patching or restrict public network access to self-hosted instances.

Jake Knott, head of threat intelligence at watchTowr, noted that attackers quickly reverse-engineered the vulnerability following publication. "watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab Path Traversal vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request," the firm warned in an advisory. Organizations have been urged to search server log files for suspicious HTTP POST requests directed at repository commits endpoints containing specific file path parameters.

In addition to the path traversal flaw, GitLab's September 10 patch release addressed 17 other security issues across versions 19.3.2, 19.2.6, and 19.1.8. This included a second critical vulnerability, CVE-2026-87719, which affects Enterprise Edition installations exclusively. Rated at 9.9 on the CVSS scale, this insecure deserialization bug in the GraphQL subscription serializer permits authenticated users with access to GitLab Duo Chat to extract Advanced Search configuration data and credentials.

Other patches included a high-severity buffer overflow in the Unicode conversion wrapper carrying a CVSS score of 8.5. This flaw can trigger remote code execution during project imports if malicious archives are processed during Advanced Search indexing. Additional fixes resolved protected CI/CD variable exposure, cross-site scripting in Markdown JSON table renderers, denial-of-service vectors in GraphQL complexity limiters, and a SAML single sign-on bypass.

Security analysts emphasize that the incident highlights a widening operational gap between automated threat discovery and enterprise maintenance schedules. Mitch Ashley, vice president and practice lead for CIO and Technology Buyers at The Futurum Group, highlighted the pressures facing internal platform teams. "The gap is between machine-speed probing and calendar-speed patching," he stated, noting that self-managed infrastructure bears the brunt of the risk while hosted cloud environments receive immediate vendor-managed remediation.

Platform administrators applying the emergency patches face additional operational hurdles. GitLab's advisory warned that certain database migrations included in the update package can induce temporary service downtime on single-node deployments, requiring careful maintenance planning. As modern software supply chain tools expand their attack surfaces through integrated artificial intelligence assistants, complex API endpoints, and granular permission architectures, security experts stress that remediation workflows must evolve beyond traditional monthly or quarterly calendar cycles.