A critical path traversal vulnerability, CVE-2026-85706, with a maximum CVSS score of 10/10, has been discovered in GitLab. The flaw allows unauthenticated attackers to access sensitive files, posing a massive risk to software supply chains.
- CVE-2026-85706 is a path traversal vulnerability with a perfect 10/10 CVSS score.
- It affects both GitLab Community Edition (CE) and Enterprise Edition (EE).
- Attackers can read arbitrary files and steal secrets, SSH configs, and credentials.
- CISA has mandated federal agencies to patch or disable self-managed instances.
Cybersecurity experts are sounding the alarm as threat actors exploit a maximum-severity vulnerability in GitLab. Disclosed recently, the flaw, identified as CVE-2026-85706, provides adversaries with a direct path into an organization's software supply chain. This vulnerability has been assigned a CVSS score of 10 out of 10, the highest possible rating for severity.
The Mechanics of the Exploit
The vulnerability is a path traversal flaw rooted in the platform's repository commits API. According to GitLab's advisory, improper path confinement and a lack of authentication checks allow unauthenticated individuals to read arbitrary files from the GitLab server. This essentially means an outsider can bypass security boundaries to access restricted data.
Cybersecurity vendor watchTowr reported that the situation escalated rapidly. Beyond just reading files, attackers have been observed dumping configuration files containing secrets and system SSH configurations. This combination is devastating, as it can lead to full host compromise through password extraction and unauthorized access.
Why This Matters
BozokMedia analysis shows that this is a textbook example of a supply chain attack. While the initial access is read-only, the information harvested—such as CI/CD secrets and credentials—can be used to pivot deeper into an organization's development environment and critical downstream systems. A single breach in a version control system can compromise every piece of software that company produces.
The combination of stolen secrets and SSH configurations allows threat actors to potentially gain full administrative control over the host system.
Historical Context
This is not an isolated incident for GitLab. Just last month, the platform faced exploitation of CVE-2026-19478, a GraphQL code injection flaw. The frequency of these critical disclosures highlights the high-value target that DevOps platforms have become for sophisticated threat actors.
Mitigation and Protection
To defend against this, organizations must immediately update their self-hosted GitLab instances. If patching is not immediately possible, administrators are urged to remove all public access to their GitLab instances to prevent unauthorized probing.
| Edition | Status | Required Action/Version |
|---|---|---|
| GitLab Community (CE) | Vulnerable | Update to 19.3.2, 19.2.6, or 19.1.8 |
| GitLab Enterprise (EE) | Vulnerable | Update to 19.3.2, 19.2.6, or 19.1.8 |
| GitLab.com (SaaS) | Patched | No action required |
Frequently Asked Questions
1. Does this affect GitLab.com users?
No, the online GitLab.com platform has already been patched and is secure.
2. What should I do if I can't update immediately?
You should immediately disable all public project visibility on your GitLab instance to mitigate the risk.
