GitLab patches CVSS 10.0 flaw as CISA sets federal deadline for today

GitLab has shipped emergency patches for CVE-2026-85706, a CVSS 10.0 path traversal vulnerability in its repository commits API that allows unauthenticated attackers to read arbitrary files from any affected self-managed instance — including SSH keys, CI/CD secrets, deploy tokens, and cloud credentials.

The flaw stems from improper path confinement and missing authentication enforcement in the API endpoint handling repository commits. The only prerequisite is that at least one public project exists on the instance, a condition met by the vast majority of GitLab deployments used by open-source teams and enterprises alike.

Exploited the same day CISA listed it

GitLab disclosed the vulnerability and released patches on September 10, 2026. The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog on September 11 — the same day internet-wide probing began, according to threat intelligence firms tracking automated reconnaissance campaigns.

Federal Civilian Executive Branch agencies face a mandatory patching deadline of September 14, 2026 — today — under CISA’s Binding Operational Directive 26-04. The agency has also required forensic triage for affected systems, acknowledging that some instances may have already been accessed before patches were applied.

What can be read — and why it matters

Successful exploitation allows retrieval of GitLab log files and configuration files such as gitlab.rb, which typically contains database credentials, secret keys, SMTP passwords, object storage credentials, and integration tokens. In CI/CD-heavy environments, project variables and runner registration tokens are also at risk.

A second vulnerability patched in the same release, CVE-2026-87719 (CVSS 9.9), addresses insecure deserialization in GitLab Enterprise Edition. Organizations running EE builds should treat both as equally urgent.

Who is affected and what to do

All Community Edition and Enterprise Edition versions from 18.7 before 19.1.8, from 19.2 before 19.2.6, and from 19.3 before 19.3.2 are vulnerable. GitLab’s patches — versions 19.3.2, 19.2.6, and 19.1.8 — close both flaws.

Organizations that cannot patch immediately should restrict public access to their self-hosted instances and block unauthenticated requests to the /api/v4/projects/{id}/repository/commits/ endpoint at the network layer. After patching, security teams should rotate all credentials that may have been stored in exposed configuration files, as first reported by The Hacker News.