Active Exploitation of Critical GitLab Flaw Risks Software Supply Chains

Threat actors are actively exploiting a maximum-severity vulnerability in GitLab that could allow attackers to infiltrate software supply chains.

The flaw, identified as CVE-2026-85706, is a path traversal vulnerability with a CVSS score of 10 out of 10. It enables unauthenticated individuals to read arbitrary files from a GitLab server by exploiting improper path confinement and missing authentication checks within the platform’s repository commits API.

Supply Chain and Credential Risks

While the vulnerability provides read-only access, the practical consequences are severe. Researchers at the cybersecurity firm watchTowr have reported seeing threat actors move beyond simple probing to full exploitation. This includes the exfiltration of sensitive files, such as configuration files containing secrets and system SSH configurations.

Jake Knott, head of threat intelligence at watchTowr, noted that obtaining these credentials could allow attackers to gain access to the host system and move laterally into an organisation’s development environment and other critical downstream systems.

CISA Mandates Patching

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-85706 to its Known Exploited Vulnerabilities catalogue. Following this designation, federal agencies have been required to patch or disable their self-managed GitLab instances.

The vulnerability specifically affects GitLab Community Edition (CE) and Enterprise Edition (EE) instances that are self-hosted. The risk is concentrated on instances that have at least one public project. Even if an organisation attempts to gate access to the system, projects explicitly marked as ‘public’ remain vulnerable to unauthenticated access.

Mitigation and Patching Guidance

GitLab has released patches to address the issue. Organisations running self-hosted instances should immediately update to one of the following versions:

• 19.3.2
• 19.2.6
• 19.1.8

For those unable to apply updates immediately, the recommended mitigation is to remove all public access to the GitLab instance. GitLab has confirmed that customers using the hosted GitLab.com platform or GitLab Dedicated are not affected by this flaw.

Security teams are also advised to review access logs for the repository commits API to identify any unauthenticated requests that may indicate probing or exploitation attempts.