Reported by 35 outlets
GitLab’s critical flaw is already drawing internet-wide probes
Why this score
- Breadth
- 2.00 / 2.0 · 35 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
GitLab patched CVE-2026-85706 (CVSS 10.0) and CVE-2026-87719. The first flaw allows unauthenticated file read on self-managed instances running releases 18.7 through 19.3; the second lets a logged-in Enterprise user with Duo Chat access inject commands that expose Advanced Search settings. Attackers are already probing the internet for these flaws, according to security firm reports cited with the advisory. GitLab's hosted service runs the fixed code, and Dedicated single-tenant customers are unaffected. Self-managed users must upgrade.
Timeline
-
original reporting
GitLab’s critical flaw is already drawing internet-wide probes
cyberscoop.com · 32d ago · September 11th, 2026
GitLab released emergency patches Thursday for two high-severity flaws in its software development platform, one of them holding the highest possible severity score, while a security firm reports that it has already seen attackers probing the internet for the flaws. The company patched the issues in new versions of both its Community Edition and Enterprise Edition, and urged those that use self-managed installations to upgrade as soon as possible. GitLab said its own hosted service already runs the fixed code, and that customers of its single-tenant Dedicated offering are not impacted. The more serious of the two flaws, tracked as CVE-2026-85706 , sits in the interface that handles repository commits. GitLab said that under certain conditions an attacker could read any file on the server, because the code failed to confine file paths properly and did not enforce authentication. An attacker does not need an account nor credentials to take advantage of the flaw. The vulnerability affects every release from 18.7 up to 19.1.8, along with the 19.2 and 19.3 lines before this week’s patches. GitLab assigned it a CVSS score of 10.0, the top of the scale used across the industry. The second flaw, CVE-2026-87719 , affects only GitLab’s Enterprise Edition. The company says a logged-in user with Duo Chat access could hide a command inside an ordinary request, prompting the server to look up its own settings for the software’s Advanced Search feature, which would return the settings and p
-
update from docs.gitlab.com
GitLab Critical Security Release: 16.0.1
docs.gitlab.com · 1240d ago · May 23rd, 2023
GitLab's May 23, 2023 critical security release fixed CVE-2023-2825, a CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) unauthenticated arbitrary file read via uploads path traversal, affecting only version 16.0.0 and exploitable when an attachment existed in a public project nested within at least five groups; reported by pwnie via HackerOne. This is the direct precedent for the September 2026 commits API flaw in the story record's CVE list, and the contrast in preconditions is stark: five nested groups then, any single public project now.
-
update from docs.gitlab.com
GitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11
docs.gitlab.com · 58d ago · August 17th, 2026
GitLab's August 17, 2026 critical patch release fixed CVE-2026-19478, a CVSS 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) issue allowing an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive, affecting CE/EE from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4, reported by hiimguardian through HackerOne. This is the earlier critical GitLab flaw watchTowr cited as almost immediately exploited in the wild, the precedent that frames the September release as the second max-severity GitLab emergency in a month.
-
update from docs.gitlab.com
GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8
docs.gitlab.com · 34d ago · September 10th, 2026
GitLab's September 10, 2026 critical patch release shipped 19.3.2, 19.2.6, and 19.1.8, fixing 18 issues including CVE-2026-85706 (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, reported by s3ntago via HackerOne) and CVE-2026-87719 (CVSS 9.9 EE GraphQL subscription serializer deserialization, reported by kyyblin). The advisory lists wider affected ranges than most coverage repeated: CE/EE all versions from 18.7 before 18.11.12 and 19.0 before 19.0.9, in addition to 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. It also credits the same release with CVE-2026-88765, a CVSS 8.5 authenticated RCE in the Advanced Search Unicode conversion wrapper, and links three GitLab threat detections for CVE-2026-85706 exploitation attempts.
-
update from securityonline.info
GitLab patched critical GitLab vulnerabilities, led by CVE-2026-85706 with a CVSS 10.0 score. Update your server now to protect source code
securityonline.info · 33d ago · September 11th, 2026
Update your server now to protect source code
via Mastodon https://securityonline.info/gitlab-vulnerabilities-cve-2026-85706-cvss-10/
-
update from cyberpress.org
GitLab Patches Critical Flaws Enabling Arbitrary File Read, Credential Theft and Remote Code Execution
cyberpress.org · 32d ago · September 11th, 2026
GitLab has released critical security updates for Community Edition and Enterprise Edition, addressing vulnerabilities that could allow unauthenticated arbitrary file reads, credential exposure, and remote code execution. Self-managed administrators should upgrade immediately to GitLab 19.3.2, 19.2.6, or 19.1.8, depending on their supported release branch. GitLab attributed the exposure to inadequate path confinement combined with missing authentication enforcement in the affected API path. The vulnerability is especially significant because it requires no credentials, no user interaction, and uses a network-based attack vector. An attacker who exploits the flaw could access sensitive server-side files, including application configuration data , secret material, tokens, or credentials stored in accessible paths. GitLab assigned the issue a CVSS vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N , indicating potential high confidentiality and integrity impact.
-
update from gbhackers.com
Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code
gbhackers.com · 32d ago · September 11th, 2026
The company released updated versions of GitLab Community Edition and Enterprise Edition, specifically versions 19.3.2, 19.2.6, and 19.1.8, on September […] The post Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from bleepingcomputer.com
GitLab urges users to patch max severity path traversal flaw
bleepingcomputer.com · 32d ago · September 11th, 2026
The security flaw, discovered by a security researcher using the ' s3ntago ' handle and reported via GitLab's HackerOne bug bounty program, stems from improper path confinement and missing authentication enforcement in the repository commits API. "These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately," the company warned on Thursday .
-
update from www.bleepingcomputer.com
GitLab urges users to patch max severity path traversal flaw https:// bleepingcomputer.com/news/security/ gitlab-urges-users-to-patch-max-se
www.bleepingcomputer.com · 32d ago · September 11th, 2026
GitLab urges users to patch max severity path traversal flaw https:// bleepingcomputer.com/news/security/ gitlab-urges-users-to-patch-max-se
via X https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-85706 (maximum severity): path traversal vulnerability in GitLab CE/EE. GitLab urges admins to patch their servers immediately. S
www.bleepingcomputer.com · 32d ago · September 11th, 2026
-
mentioned by thecybersecguru.com
🚨 Critical GitLab Security Alert GitLab has patched CVE-2026-85706, a CVSS 10.0 path traversal vulnerability** affecting self-managed instal
thecybersecguru.com · 32d ago · September 11th, 2026
-
update from securityweek.com
GitLab Vulnerability Exploited One Day After Disclosure
securityweek.com · 32d ago · September 11th, 2026
Threat actors have started exploiting a newly patched vulnerability in GitLab one day after public disclosure, attack surface management firm WatchTowr warns. “This is the second instance of a critical-severity GitLab vulnerability in recent weeks, following the previous GraphQL code injection (CVE-2026-19478) that was almost immediately actively exploited ,” Jake Knott, head of threat intelligence at WatchTowr, said. According to WatchTowr, mass exploitation of the vulnerability is likely to follow shortly. “Defenders should hunt through log files for HTTP POST requests to ‘/api/v4/projects/{id}/repository/commits/’ URIs containing ‘file.path’ parameters to identify potential exploitation attempts,” the company noted. Self-hos
-
update from cyber.netsecops.io
📰 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability GitLab releases emergency patches for a critical CVSS 10.0 path traversal f
cyber.netsecops.io · 32d ago · September 11th, 2026
📰 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability GitLab releases emergency patches for a critical CVSS 10.0 path traversal f
via Mastodon https://cyber.netsecops.io/articles/gitlab-urges-patching-of-critical-cvss-10-path-traversal-flaw/?utm_source=mastodon&utm_medium=social&utm_campaign=daily
-
update from malware.news
GitLab security advisory (AV26-917)
malware.news · 32d ago · September 11th, 2026
Serial Number: AV26-917 Date: September 11, 2026 As of September 10, 2026, GitLab is affected by vulnerabilities in the following product: GitLab Prior to 19.1.8 Prior to 19.2.6 Prior to 19.3.2 On September 11, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
-
mentioned by thehackernews.com
🤖 CVE-2026-85706 (CVSS 10.0): path traversal in GitLab's repository commits API lets unauthenticated users read arbitrary files from the ser
thehackernews.com · 32d ago · September 11th, 2026
-
update from malware.news
GitLab security advisory AV26-917 — a reminder that CI/CD platforms remain prime targets: they centralize credentials, pipelines
malware.news · 32d ago · September 11th, 2026
GitLab security advisory AV26-917 — un rappel que les plateformes de CI/CD restent des cibles de choix : elles centralisent credentials, pip
via Mastodon https://malware.news/t/gitlab-security-advisory-av26-917/125543
-
mentioned by threatnoir.com
⚠️ CRITICAL: GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure GitLab patched a CVSS 10.0 unauthenticated file-read vu
threatnoir.com · 32d ago · September 12th, 2026
-
update from dev.to
1. Basic Information Original Title: GitLab urges users to patch max severity path... # security # threatintel # software # coding # develop
dev.to · 32d ago · September 12th, 2026
Basic Information Original Title: GitLab urges users to patch max severity path... # security # threatintel # software # coding # develop
via Mastodon https://dev.to/anoymask/gitlab-cve-2026-85706-active-scanning-targeting-pre-authentication-file-read-591b
-
mentioned by suriq.io
⚠️ PATCH NOW GitLab shipped a critical patch: CVE-2026-85706 lets an unauthenticated attacker read files, including secrets, off a self-mana
suriq.io · 32d ago · September 12th, 2026
-
mentioned by www.thehackerwire.com
🔴 CVE-2026-87719 - Critical (9.9) GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19
www.thehackerwire.com · 32d ago · September 12th, 2026
-
mentioned by www.thehackerwire.com
🔴 CVE-2026-85706 - Critical (10) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before
www.thehackerwire.com · 32d ago · September 12th, 2026
-
mentioned by cyberworldops.eu
GitLab path-traversal CVE-2026-85706 (CVSS 10.0) is being exploited in the wild one day after disclosure. It allows unauthenticated arbitrar
cyberworldops.eu · 32d ago · September 12th, 2026
-
update from cyberpress.org
CISA Warns of Critical GitLab Path Traversal Flaw Exploited to Read Arbitrary Server Files
cyberpress.org · 32d ago · September 12th, 2026
CISA Warns of Critical GitLab Path Traversal Flaw The flaw is categorized as CWE-35, a path traversal weakness that occurs when an application fails to properly restrict file-path operations to an expected directory. In practical terms, an attacker could potentially use crafted traversal sequences to access sensitive files outside the GitLab repository path, depending on the permissions of the affected GitLab service process. Potentially exposed files could include application configuration files, secrets, API credentials, deployment tokens, private keys, environment variables, and other server-side data. Access to such material could enable follow-on attacks, including GitLab account compromise, cloud-environment access, source-code theft, or lateral movement into connected CI/CD infrastructure .
-
mentioned by gbhackers.com
CISA Warns of Critical GitLab Vulnerability Exploited in Attacks
gbhackers.com · 31d ago · September 12th, 2026
-
mentioned by thehackernews.com
🤖 CVE-2026-85706 (CVSS 10.0): path traversal in GitLab's repository commits API lets unauthenticated users read arbitrary files from the ser
thehackernews.com · 31d ago · September 12th, 2026
-
mentioned by cyberwald.com
Cyberwald - Cybersecurity News - 09.12.2026 Today in the podcast: GitLab CVE-2026-85706 (CVSS 10.0): Path Traversal in the Commits API
cyberwald.com · 31d ago · September 12th, 2026
-
mentioned by beyondmachines.net
GitLab Patches Critical Path Traversal Flaw Under Active Exploitation GitLab released emergency patches for 18 vulnerabilities, including a
beyondmachines.net · 31d ago · September 12th, 2026
-
mentioned by www.yazoul.net
🔴 New security advisory: CVE-2026-85706 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R
www.yazoul.net · 31d ago · September 12th, 2026
-
update from cyberscoop.com
GitLab's critical flaw is already drawing internet-wide probes
cyberscoop.com · 31d ago · September 12th, 2026
submitted by /u/DerBootsMann [link] [comments]
via reddit r/cybersecurity: GitLab's critical flaw is already drawing internet-wide probes
-
mentioned by threat-intelligence.redeyesecurity.com
GitLab CVE-2026-85706: a CVSS 10.0 pre-auth arbitrary file read, with a three-day patch window. No credentials required to reach it. GitLab
threat-intelligence.redeyesecurity.com · 31d ago · September 12th, 2026
-
update from endoflife.ai
📖 New from endoflife.ai: GitLab CVE-2026-85706: Six Lines Without a Fix, 19.1 Ends September 17 https:// endoflife.ai/article-gitlab-cv e-20
endoflife.ai · 31d ago · September 12th, 2026
📖 New from endoflife.ai: GitLab CVE-2026-85706: Six Lines Without a Fix, 19.1 Ends September 17 https:// endoflife.ai/article-gitlab-cv e-20
via Mastodon https://endoflife.ai/article-gitlab-cve-2026-85706-six-lines-without-a-fix
-
mentioned by cyber.netsecops.io
📰 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability GitLab releases emergency patches for a critical CVSS 10.0 path traversal f
cyber.netsecops.io · 31d ago · September 12th, 2026
-
mentioned by www.yazoul.net
🔵 THREAT INTELLIGENCE GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Vulnerability | CRITICAL CVEs: CVE-2026-85706
www.yazoul.net · 31d ago · September 12th, 2026
-
update from www.securityweek.com
That is a faster turnaround than most people's pizza delivery. Patch GitLab immediately to remediate CVE-2026-85706 — your self-managed serv
www.securityweek.com · 31d ago · September 12th, 2026
That is a faster turnaround than most people's pizza delivery.
-
mentioned by cyberworldops.eu
GitLab CVE-2026-85706 is a maximum-severity path traversal in the repository commits API enabling unauthenticated arbitrary file read on sel
cyberworldops.eu · 31d ago · September 12th, 2026
-
mentioned by www.bleepingcomputer.com
# GitLab urges users to patch max severity path traversal flaw https://www. bleepingcomputer.com/news/secu rity/gitlab-urges-users-to-patch-
www.bleepingcomputer.com · 31d ago · September 12th, 2026
-
mentioned by cyber.netsecops.io
📰 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability GitLab releases emergency patches for a critical CVSS 10.0 path traversal f
cyber.netsecops.io · 30d ago · September 13th, 2026
-
mentioned by www.valtersit.com
CVE-2026-87719 GitLab EE: authed Duo Chat user can leak Advanced Search configs and credentials via crafted GraphQL subscription, CVSS 9.9.
www.valtersit.com · 29d ago · September 14th, 2026
-
update from bleepingcomputer.com
CISA: Hackers now exploit max severity GitLab flaw in attacks
bleepingcomputer.com · 29d ago · September 14th, 2026
GitLab's DevSecOps platform is used by over 50% of Fortune 100 companies and has over 30 million registered users worldwide. "Based on recent GitLab vulnerabilities, we know the time until indiscriminate exploitation is likely not far away.
-
mentioned by www.bleepingcomputer.com
CISA: Hackers now exploit max severity GitLab flaw in attacks https:// bleepingcomputer.com/news/security/ cisa-hackers-now-exploit-max-seve
www.bleepingcomputer.com · 29d ago · September 14th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 CISA warns CVE-2026-85706, a max-severity GitLab flaw, is now exploited in the wild. Missing auth + path confinement in the commits API le
www.bleepingcomputer.com · 29d ago · September 14th, 2026
-
update from radar.offseq.com
CRITICAL GitLab vulnerability is being actively exploited, per CISA. No technical details or affected versions released yet. Monitor advisor
radar.offseq.com · 29d ago · September 14th, 2026
No technical details or affected versions released yet. Monitor advisor
via Mastodon https://radar.offseq.com/threat/cisa-hackers-now-exploit-max-severity-gitlab-flaw-in-attacks-fbc70b60d8092d92
-
mentioned by www.bleepingcomputer.com
⋅ CISA: Hackers now exploit max severity GitLab flaw in attacks − https://www. bleepingcomputer.com/news/secu rity/cisa-hackers-now-exploit-
www.bleepingcomputer.com · 29d ago · September 14th, 2026
-
mentioned by www.valtersit.com
CVE-2026-85706 GitLab CE/EE: unauthenticated arbitrary file read via commits API, CVSS 10. Affects 18.7 up to 19.1.8, 19.2.6, 19.3.2. No pat
www.valtersit.com · 29d ago · September 14th, 2026
-
mentioned by www.bleepingcomputer.com
"CISA: Hackers now exploit max severity GitLab flaw in attacks" "[...] Cybersecurity and Infrastructure Security Agency (CISA) warned that h
www.bleepingcomputer.com · 29d ago · September 14th, 2026
-
mentioned by www.programmez.com
[VULN] GitLab: critical security update CVE-2026-85706
www.programmez.com · 29d ago · September 14th, 2026
-
update from socprime.com
CVE-2026-85706: Critical GitLab Path Traversal Flaw Exploited in the Wild
socprime.com · 29d ago · September 14th, 2026
Security researchers observed internet-wide probing beginning at approximately 06:00 UTC on September 11, 2026, shortly after GitLab released patches. CVE-2026-85706 analysis The vulnera
-
mentioned by www.rapid7.com
New. Rapid7: CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild https://www. rapid7.com/blog/post/etr-cve-2 026-85706-crit
www.rapid7.com · 29d ago · September 14th, 2026
-
mentioned by nvd.nist.gov
🤖 CVE-2026-85706 (CVSS 10.0): unauthenticated arbitrary file read in GitLab CE/EE via the repository commits API (improper path confinement)
nvd.nist.gov · 29d ago · September 14th, 2026
-
update from www.linkedin.com
GitLab Path Traversal Vulnerability CVE-2026-85706 Exploitation Imminent | watchTowr posted on the topic | LinkedIn https:// suppo.fi/post/1
www.linkedin.com · 28d ago · September 15th, 2026
GitLab Path Traversal Vulnerability CVE-2026-85706 Exploitation Imminent | watchTowr posted on the topic | LinkedIn https:// suppo.fi/post/1
via Mastodon https://www.linkedin.com/posts/watchtowr-intel-is-already-observing-in-the-wild-share-7504127030326673408-E8qx/
-
mentioned by censys.com
🚨 GitLab CVE-2026-85706 is a critical CVSS 10.0 vulnerability under active exploitation. Censys sees 86K+ GitLab hosts on the Internet. Patc
censys.com · 28d ago · September 15th, 2026
-
mentioned by insomnisec.com
GitLab Path Traversal (CVE-2026-85706): A Perfect 10 Under Active Attack If your organization writes software or produces code, there is a g
insomnisec.com · 28d ago · September 16th, 2026
-
mentioned by meterpreter.org
Learn why CISA added GitLab CVE-2026-85706 to the Known Exploited Vulnerabilities catalog. Discover how this CVSS 10 flaw allows remote secr
meterpreter.org · 28d ago · September 16th, 2026
-
mentioned by cybersecurefox.com
GitLab CVE-2026-85706: critical vulnerability with CVSS 10.0 🔗 https:// cybersecurefox.com/en/cve-2026 -85706-gitlab-cvss-10-file-reading #
cybersecurefox.com · 26d ago · September 17th, 2026
-
mentioned by diesec.com
GitLab CVE-2026-85706 (CVSS 10.0): unauthenticated attackers read ANY file off self-managed servers, no login needed. Exploited within hours
diesec.com · 22d ago · September 21st, 2026
-
mentioned by www.offsec.com
(offsec.com) Critical Unauthenticated Arbitrary File Read Vulnerability in GitLab (CVE-2026-85706): Analysis and Exploitation Insights In br
www.offsec.com · 15d ago · September 28th, 2026
-
mentioned by www.truesec.com
(truesec.com) Critical GitLab Vulnerability CVE-2026-85706 Enables Unauthenticated Arbitrary File Read and Potential Full Compromise In brie
www.truesec.com · 14d ago · September 29th, 2026
-
update from malware.news
CVE-2026-85706: Critical GitLab Unauthenticated Arbitrary File Read Vulnerability (CVSS 10.0)
malware.news · 14d ago · September 29th, 2026
Due to the body-upload helper processing the file.path parameter before authentication and failing to restrict it to repository paths, an unauthenticated attacker can cause GitLab to read arbitrary files accessible to the GitLab service process. The vulnerability can be exploited by URL-encoding one character in the commits route—for example, using %63ommits, which bypasses GitLab Workhorse route handling while Rails still processes the request. When combined with a URL-encoded form request, file contents containing invalid percent-encoding sequences may be reflected in the server’s error response. Other files may still be exposed through an existence or readability oracle. CVE CVE-2026-85706 Affected Products GitL
-
mentioned by cyberscoop.com
GitLab’s critical flaw is already drawing internet-wide probes https:// cyberscoop.com/gitlab-critical -flaws-path-traversal-scans/ # cybers
cyberscoop.com · 12d ago · October 1st, 2026