CISA Warns Hackers Are Exploiting Critical GitLab Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that hackers are actively exploiting a maximum-severity vulnerability in GitLab’s DevSecOps platform.

The security flaw, tracked as CVE-2026-85706, is a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through a single HTTP request. The issue stems from missing authentication enforcement and improper path confinement within the repository commits API.

Successful exploitation enables attackers to access highly sensitive information, including credentials, secrets, and other private data stored on vulnerable servers.

Widespread Risk to Enterprise Infrastructure

GitLab is a critical tool in modern software development, used by over 30 million registered users and more than 50% of Fortune 100 companies. The scale of its adoption means that unpatched systems pose a significant risk to both large-scale enterprises and the broader digital supply chain.

While GitLab had not initially categorised the flaw as actively exploited, cybersecurity firm watchTowr reported observing attackers probing the internet for unpatched GitLab instances. Following these reports, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue.

The inclusion of the flaw in the KEV catalogue triggers Binding Operational Directive (BOD) 26-04, which mandates that federal agencies secure their systems against the vulnerability within three days. Although the directive applies only to federal agencies, CISA has encouraged all organisations, including the private sector, to prioritise immediate remediation.

Patching and Detection Guidance

GitLab has released patches to address the vulnerability. Users of GitLab Community Edition (CE) and Enterprise Edition (EE) are urged to update to versions 19.3.2, 19.2.6, or 19.1 immediately.

In addition to patching, security teams should conduct forensic hunts through their log files to identify potential exploitation attempts. Defenders are advised to look for HTTP POST requests directed to the /api/v4/projects/{id}/repository/commits/ URI that contain file.path parameters.