GitLab's New Path-Traversal Bug Scored a 10.0. Attackers Found It Before CISA Did.
CVE-2026-85706 lets anyone with no account read arbitrary files off a self-managed GitLab server through the repository commits API. GitLab shipped the fix on September 10; watchTowr's honeypots caught probing attempts the next day.
CVE Tools5 min read
On September 10, 2026, GitLab shipped patch releases 19.3.2, 19.2.6 and 19.1.8 for Community and Enterprise Edition. The headline fix, CVE-2026-85706, needs no username, no password, and no session — just a single HTTP request to an API endpoint most GitLab admins never think about.
Scores as of 2026-09-12live record →
What's actually broken
GitLab's own advisory describes the root cause plainly: "improper path confinement and missing authentication enforcement" in the repository commits API. The API is supposed to answer questions about a specific commit inside a specific repository — but a crafted path value lets it escape the repository directory entirely and hand back the contents of arbitrary files on the server, without checking whether the caller is logged in at all.
CVE-2026-85706 in one request
- Unauthenticated request — No account, token or cookie required
- Repository commits API — Path value not confined to the repo directory
- Path traversal (CWE-22)
- Arbitrary file read — Server-side files outside the repo tree
- Secrets / config exposure
Who's exposed
| Branch | Vulnerable versions | Fixed in |
|---|---|---|
| 18.7 – 19.1.x | from 18.7 up to 19.1.8 | 19.1.8 |
| 19.2.x | 19.2 up to 19.2.6 | 19.2.6 |
| 19.3.x | 19.3 up to 19.3.2 | 19.3.2 |
The 24-hour clock
- GitLab ships 19.3.2, 19.2.6, 19.1.8Fixes CVE-2026-85706 alongside CVE-2026-87719 and other issues in the same patch cycle.
- watchTowr sees honeypot probesBehavioral scans for the path-traversal pattern hit watchTowr's Attacker Eye network less than a day after the patch shipped.
- CISA adds CVE-2026-85706 to KEVListed under Binding Operational Directive 26-04, which also requires forensic triage, not just patching.
- Federal remediation deadlineThree-day window for FCEB agencies — the standard BOD 26-04 clock for confirmed exploitation.
We are already seeing behavioral probes for this vulnerability against Attacker Eye. Given the low complexity of exploitation, we assess with high confidence that this vulnerability will rapidly transition to indiscriminate, in-the-wild exploitation.
Detecting it
watchTowr published the concrete request pattern to hunt for rather than a signature file — worth building your own rule around it.
Also patched the same day
The same release fixed CVE-2026-87719, a CVSS 9.9 deserialization bug in GitLab EE's GraphQL subscription serializer. It needs an authenticated account with Duo Chat access, but a crafted GraphQL subscription argument can bypass serialization controls, trigger a server-side object lookup, and expose Advanced Search instance configuration and credentials. Lower barrier to entry than CVE-2026-85706, higher privilege requirement — different threat model, same patch window.
| CVE-2026-85706 | CVE-2026-87719 | |
|---|---|---|
| CVSS | 10.0 | 9.9 |
| Weakness | CWE-22 path traversal | CWE-502 deserialization |
| Auth required | None | Authenticated + Duo Chat access |
| Edition | CE and EE | EE only |
| Impact | Arbitrary server file read | Credential and config exposure |
GitLab's growing KEV file
CVE-2026-85706 is the fifth GitLab CVE our own index shows on CISA's Known Exploited Vulnerabilities catalog — and the first to hit a perfect 10.0 since the ImageTragick-style RCE five years ago.
| CVE | Disclosed | CVSS | Bug class | Added to KEV |
|---|---|---|---|---|
| CVE-2021-22205 | 2021-04-23 | 10.0 | Unrestricted file-type RCE via image parser | 2021 |
| CVE-2023-7028 | 2024-01-12 | 10.0 | Password reset to unverified email | 2024 |
| CVE-2021-22175 | 2021-06-11 | 6.8 | SSRF via internal webhooks | 2026-02 |
| CVE-2021-39935 | 2021-12-13 | 6.8 | SSRF via CI Lint API | 2026-02 |
| CVE-2026-85706 | 2026-09-12 | 10.0 | Path traversal in commits API | 2026-09 |
What to do
- Upgrade self-managed GitLab CE/EE to 19.3.2, 19.2.6 or 19.1.8 (or later) immediately — there is no vendor-sanctioned workaround.
- Single-node instances will see downtime during the upgrade because database migrations must finish before GitLab restarts; plan the window.
- If you can't patch immediately, restrict network access to the instance as a temporary measure only — not a substitute for patching.
- Review access and reverse-proxy logs for requests to the repository commits API carrying path-traversal-style parameters, especially from unauthenticated sources.
- If you're on GitLab EE with Duo Chat enabled, patch for CVE-2026-87719 in the same pass and review who has Duo Chat access.
CVE and KEV data as of 2026-09-12