GitLab Patches Maximum Severity Vulnerability in CI/CD Infrastructure

GitLab has released urgent patches for a maximum-severity vulnerability, tracked as CVE-2026-85706, which allows unauthenticated attackers to read arbitrary files on vulnerable servers. The flaw, which carries a CVSS severity score of 10.0, enables threat actors to access sensitive information, including credentials and secrets, through a single HTTP request.

The vulnerability is a path traversal flaw resulting from improper confinement and a lack of authentication enforcement within GitLab’s repository commits API. Attackers can exploit the bug under certain conditions to extract configuration files and other sensitive server-side data.

Active Exploitation Reported

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-85706 to its Known Exploited Vulnerabilities catalogue, noting the significant risk it poses to federal enterprises. Furthermore, threat intelligence firm watchTowr Intel has reported observing active probes in the wild targeting this specific flaw.

Security experts warn that because GitLab functions as a central component of DevSecOps workflows, the impact of such a breach can extend far beyond the initial instance. Safayat Moahamad, advisory director at Info-Tech Research Group, noted that GitLab is often connected to build pipelines, deployment processes, and other trusted systems, making it a high-value target for lateral movement and supply chain compromises.

Affected Versions and Patching

The vulnerability impacts both GitLab Community Edition (CE) and Enterprise Edition (EE). Organisations running self-managed instances are advised to patch immediately. The affected versions include:

• 18.7 (fixed in 19.1.8)
• 19.2 (fixed in 19.2.6)
• 19.3 (fixed in 19.3.2)

For those unable to patch immediately, GitLab advises removing public access to self-hosted instances to mitigate the risk of unauthenticated exploitation.

Detection and Mitigation Strategies

Defenders are encouraged to hunt for signs of exploitation by reviewing log files for suspicious activity. Specifically, watchTowr Intel recommends searching for HTTP POST requests directed at the /api/v4/projects/{id}/repository/commits/ URI that contain file.path parameters.

Beyond applying the security updates, organisations should investigate whether any exposed files contained usable tokens, SSH keys, or cloud secrets. If there is any suspicion that credentials may have been accessed, a full rotation of those secrets is recommended to prevent attackers from hijacking connected cloud infrastructure or committing ransomware.

David Shipley of Beauceron Security highlighted that the severity is compounded by common developer practices, such as embedding secrets directly into production code. He urged enterprises to adopt modern authentication best practices and remove sensitive data from source code to reduce the potential for data exfiltration and extortion.