Threat actors have begun exploiting a critical path traversal vulnerability in GitLab just one day after its disclosure. The flaw allows unauthenticated attackers to read sensitive server files, prompting urgent warnings for self-hosted instances.

  • CVE-2026-85706 carries a maximum CVSS score of 10/10, allowing unauthorized file access.
  • Attackers are already probing systems using specific HTTP POST requests to project URIs.
  • Patches are available for CE and EE versions 19.1.8, 19.2.6, and 19.3.2.
  • Additional critical flaws, including an insecure deserialization bug (CVE-2026-87719), are also addressed.

In a rapid escalation of cyber threats, the attack surface management firm WatchTowr has revealed that threat actors are already exploiting a newly patched critical vulnerability in GitLab. The window between the public disclosure of the flaw and the first observed in-the-wild attacks was less than 24 hours, highlighting the speed at which modern adversaries weaponize security advisories.

The primary vulnerability, tracked as CVE-2026-85706, is a path traversal issue with a devastating CVSS score of 10/10. This flaw enables unauthenticated users to read arbitrary files directly from the GitLab server via a single HTTP request. Affected versions include Community Edition (CE) and Enterprise Edition (EE) versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.

Read Also:Apple May Shift iPhone Launch Strategy: iPhone 18 Pro to Precede Standard Model

Why This Matters

BozokMedia analysis shows that the speed of this exploitation indicates that threat actors are monitoring security bulletins in real-time to create 'one-day' exploits. Because GitLab often stores sensitive environment variables, SSH keys, and source code, a path traversal vulnerability is not just a data leak—it is a potential gateway to a full system compromise across the entire CI/CD pipeline.

The transition from patch release to active exploitation has shrunk to hours, making manual update cycles a liability for enterprise security.

Beyond the primary flaw, the latest GitLab updates resolve 17 other vulnerabilities. Among these is CVE-2026-87719 (CVSS 9.9), an insecure deserialization issue in the GraphQL subscription serializer. If left unpatched, this could allow attackers to access advanced search instance configurations and highly sensitive credentials.

Security teams are urged to hunt for indicators of compromise (IoC). Specifically, administrators should scan log files for HTTP POST requests directed at /api/v4/projects/{id}/repository/commits/ URIs that contain file.path parameters, as these are hallmarks of the current exploitation attempts.

Vulnerability ID CVSS Score Impact Type Risk Level
CVE-2026-85706 10.0 Path Traversal / Arbitrary File Read Critical
CVE-2026-87719 9.9 Insecure Deserialization Critical
Did You Know?: Path traversal attacks, also known as directory traversal, trick a web application into accessing files and directories stored outside the web root folder by using characters like '../'.

Frequently Asked Questions

Q: Which GitLab versions are most at risk?
A: Self-hosted versions of CE and EE prior to 19.1.8, 19.2.6, and 19.3.2 are vulnerable.

Q: How can I tell if my server was targeted?
A: Check your logs for suspicious POST requests to the repository commits API containing 'file.path' parameters.