GitLab CVSS 10.0 flaw already under attack

GitLab shipped emergency patches on September 10 for a flaw in its repository commits API that scores a maximum 10.0 on the CVSS scale. Four days later, security firm watchTowr was already seeing scans for it against internet-facing GitLab servers.

The bug, CVE-2026-85706, combines improper path confinement with a missing authentication check in the commits API, according to GitLab's patch notes. A single crafted request, with no login, can read arbitrary files from a vulnerable server, including source code, configuration and stored credentials. It affects self-hosted GitLab Community and Enterprise Edition from 18.7 onward.

The fixed versions are 19.3.2, 19.2.6 and 19.1.8, released September 10, and 19.0.9 and 18.11.12, backported on September 23. Any earlier release from 18.7 on is affected.

watchTowr says exploitation takes one HTTP request, and advises taking unpatched internet-facing instances offline rather than waiting for a maintenance window. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 11.

If you run self-hosted GitLab, upgrade to the fixed release for your branch. Then check access logs for POST requests to /api/v4/projects/{id}/repository/commits/ that include a file.path parameter; that pattern marks both the exploit and the scans. Arbitrary file reads can expose CI secrets and deploy keys, so a match is a reason to start incident response and rotate them.

Correction, October 23, 2026: we've added the 19.0.9 and 18.11.12 fixes GitLab released on September 23. An earlier version listed only the September 10 releases.