GitLab CVE-2026-85706: one request reads any file

If you run self-managed GitLab, stop reading after this paragraph and go check your version. GitLab CVE-2026-85706 is a CVSS 10.0 unauthenticated path traversal in the repository commits API. One HTTP POST, no credentials, and an attacker reads arbitrary files off the server — including the config files where your CI secrets live. GitLab shipped the fix on September 10. Attack traffic showed up the next morning.

What actually happened

GitLab published a critical patch release — 19.3.2, 19.2.6 and 19.1.8 on September 10, closing 17 vulnerabilities. CVE-2026-85706 is the one that scored a perfect 10: improper path confinement plus missing authentication enforcement on POST /api/v4/projects/{id}/repository/commits/, reachable through the file.Path parameter.

Affected builds are CE and EE from 18.7 up to 19.1.7, 19.2.0 to 19.2.5, and 19.3.0 to 19.3.1. The only precondition is that your instance hosts at least one public project — that's the whole entry requirement. watchTowr's threat intel head Jake Knott put it plainly in The Hacker News writeup: one requirement, one public project. watchTowr's honeypot network logged in-the-wild probes starting 06:00 UTC on September 11. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until September 14.

Two more in the same release deserve your attention: a 9.9 insecure deserialization that leaks Advanced Search credentials through GraphQL, and an 8.5 buffer overflow that reaches remote code execution through a crafted Git project import.

GitLab.com is already patched. GitLab Dedicated needs no action. Self-managed is your problem.

Why this matters for your business

A file-read bug on a Git server is not a file-read bug. It is a credential bug. Your GitLab box holds deploy keys, runner registration tokens, CI/CD variables, database URLs, and the gitlab.rb that ties them together. Read those and an attacker doesn't need another exploit — they push code into your pipeline and your own automation deploys it.

Patch tonight, not this weekend. The KEV listing means exploitation is confirmed, not theoretical. The patch includes database migrations, so single-node installs take downtime while they run. Budget for it instead of postponing.

Then rotate. If your instance was internet-reachable and unpatched between September 10 and whenever you upgrade, treat CI secrets as exposed. Rotate runner tokens, CI variables, and any cloud credentials stored in project settings.

Then audit your public projects. The precondition was one public project. Most shops have one by accident — an old docs repo, a template, something a contractor flipped visibility on in 2023. That accident is your attack surface.

Sources: GitLab Critical Patch Release 19.3.2, 19.2.6, 19.1.8, The Hacker News.