How the Vulnerability Works
The vulnerability is a path traversal issue located in GitLab’s repository commits API. According to the advisory, a specially crafted HTTP POST request to the endpoint /api/v4/projects/{id}/repository/commits/ containing a file.path parameter can allow an attacker to read arbitrary files on the server. Unlike many authentication flaws that require compromised credentials or bypassing two-factor authentication (2FA), this issue requires no prior authentication. An attacker with network access to the GitLab instance can issue the request to exfiltrate data.
The potential impact is severe because GitLab instances often store highly sensitive configuration data. Exploiting this flaw could expose SSH keys, database credentials, deploy tokens, CI/CD variables, and cloud provider keys. In the context of software supply chains, compromise of these artifacts could allow attackers to inject malicious code into trusted build pipelines or pivot into other internal systems. Security researchers at watchTowr confirmed that they observed in-the-wild probes targeting this specific endpoint shortly after disclosure.
Scope and Affected Versions
The vulnerability affects both GitLab Community Edition (CE) and Enterprise Edition (EE). The affected version ranges are broad, spanning recent major releases:
- Versions 18.7 through 19.1.7
- Versions 19.2 through 19.2.5
- Versions 19.3 through 19.3.1
GitLab has released patched versions 19.1.8, 19.2.6, and 19.3.2 to address the flaw. The company also noted that GitLab.com, its hosted service, is already running patched software, and customers using GitLab Dedicated do not need to take action. However, organizations running self-managed instances are strongly urged to apply the updates immediately or, if patching is delayed, to remove public internet access to their instances.
Active Exploitation and Detection
The speed at which attackers moved against this vulnerability mirrors previous high-profile GitLab incidents, such as CVE-2023-2825, which was also exploited for arbitrary file reads shortly after disclosure. The current incident underscores the persistent threat to developer infrastructure, which has become a primary target for cybercriminals and nation-state actors seeking to disrupt supply chains.
To identify potential compromise, security teams are advised to audit log files for HTTP POST requests to the repository commits API that contain file.path parameters. The presence of such requests, particularly from untrusted IP addresses, may indicate an attempted or successful exploitation. If evidence of successful file access is found, organizations must rotate all credentials that may have been exposed, including tokens, SSH keys, and CI/CD variables, to prevent further lateral movement by attackers.
Broader Context of GitLab Security
While CVE-2026-85706 is the most critical recent disclosure, it is part of a series of high-severity vulnerabilities affecting the platform. In a related advisory, GitLab also patched a series of flaws including CVE-2026-0723, a high-severity authentication bypass that could circumvent 2FA if an attacker possessed a victim’s account identifier. Additionally, several denial-of-service (DoS) vulnerabilities, such as CVE-2025-13927 and CVE-2025-13928, were addressed in recent updates. These DoS flaws allowed unauthenticated attackers to disrupt services by sending malformed authentication data or exploiting improper authorization validation in API endpoints.
The scale of GitLab’s deployment amplifies the risk. According to data from the nonprofit Internet security monitoring group Shadowserver, nearly 6,000 GitLab Community Edition instances are accessible online, while the search engine Shodan suggests that more than 45,000 devices worldwide carry a detectable GitLab fingerprint. Not all of these systems are necessarily vulnerable or unpatched, but the figures highlight the substantial attack surface available to malicious actors.
GitLab’s position in the industry makes it a high-value target. The company serves more than 30 million registered users and is relied upon by major global organizations, including Nvidia, Airbus, Lockheed Martin, and Goldman Sachs. As organizations continue to automate development and deployment through CI/CD pipelines, the security of these platforms becomes a critical component of overall digital resilience. The rapid exploitation of CVE-2026-85706 serves as a stark reminder that DevOps infrastructure must be secured with the same rigor as production environments.
For self-managed administrators, the immediate next steps are clear: verify the current version of the GitLab instance, apply the latest patched updates (19.1.8, 19.2.6, or 19.3.2) immediately, and initiate a forensic review of API logs for signs of the specific path traversal pattern described by watchTowr.
One Comment