CVE-2026-85706

This is a security bug in GitLab where an attacker can trick the system into looking at the wrong file paths—so it can hand out files it should never expose. Imagine leaving a “back door” that lets a stranger open a closet labeled “Staff Confidential” without needing any key.

This matters if you run GitLab CE or EE (a self-hosted GitLab server) and your version is older than the fixed releases (before 19.1.8 / 19.2.6 / 19.3.2). The problem is reachable over the network, requires no login, and has been reported as exploited in real attacks. The risk is especially serious when your GitLab server is reachable from the internet and you’re running a vulnerable version.

This is RED because attackers are actively exploiting it in the wild, and CISA has included it in its KEV catalog with a specific remediation deadline. With no login required and a default-reachable configuration, unpatched servers are directly at risk right now.

1. Confirm exposure

• Determine the exact GitLab version running in production (from the GitLab admin/version page or your deployment tooling).
• Mark the server as vulnerable if it is:
  • less than 19.1.8, OR
  • less than 19.2.6, OR
  • less than 19.3.2,
    corresponding to the relevant release line you’re on.

2. Verify whether you’ve been targeted (quick checks)

• Review GitLab access logs and any application logs around 2026-09-11 onward for unusual requests from external IPs.
• Look for evidence of file-access attempts tied to repository commits API behavior (your logs/search tooling may show suspicious request patterns even if exact strings vary).
• If you have centralized logging, search for spikes in 4xx/5xx errors and bursty traffic consistent with probing.

3. Patch (preferred remediation)

• Upgrade GitLab to the fixed version for your current release line:
  • 19.1.8 or above, OR
  • 19.2.6 or above, OR
  • 19.3.2 or above.
• Plan for a normal upgrade window and follow your organization’s change-control process.

4. Temporary mitigation if patching is delayed

• Follow the vendor’s mitigation instructions for CVE-2026-85706 immediately (do not rely only on generic hardening).
• If your mitigation options do not fully address the exploit conditions, discontinue use of the product until patched/mitigated, consistent with CISA guidance.

5. Compliance / timeline

• CISA KEV due date for remediation is 2026-09-14.
• After upgrade/mitigation, continue monitoring logs for additional probing attempts.

6. Ongoing monitoring

• Keep watching for continued automated scanning traffic; exploitation attempts may continue until many servers are patched.

Severity is critical with network access and no user interaction, and CISA has confirmed it via KEV (listed 2026-09-11) with an issued remediation due date (2026-09-14). The weakness is CWE-22 (path traversal): under specific conditions involving the repository commits API, the application fails to properly confine file paths and does not enforce authentication correctly, enabling an unauthenticated remote attacker to read arbitrary files. Real-world exploitation is reported, including probes against unpatched GitLab servers starting shortly after disclosure (2026-09-11). Public prediction signals (EPSS) are not a decision driver here because KEV/news confirm active exploitation. Fixed versions are 19.1.8, 19.2.6, and 19.3.2+.