GitLab Releases Fixes for Critical File-Read Flaw Reportedly Targeted by Early Probes

GitLab has issued security updates for several vulnerabilities, including a maximum-severity path traversal flaw that researchers say began attracting internet-wide probing shortly after its public disclosure.

The most serious issue, tracked as CVE-2026-85706 and rated CVSS 10.0, affects GitLab's repository commits API. According to GitLab, inadequate path restrictions and missing authentication checks could, in certain configurations, let an unauthenticated attacker read arbitrary files from a vulnerable server.

The affected releases include GitLab Community Edition and Enterprise Edition versions from 18.7 through versions before 19.1.8, releases before 19.2.6 in the 19.2 branch, and releases before 19.3.2 in the 19.3 branch. GitLab has made patched versions 19.1.8, 19.2.6, and 19.3.2 available.

WatchTowr, an exposure management company, said it observed attempts to probe for the vulnerability beginning September 11. The company said attackers could potentially use the issue to access logs and GitLab configuration data that may contain credentials, secrets, or other sensitive information. Exploitation reportedly requires a publicly accessible project on the targeted instance.

GitLab servers can hold valuable development assets, including source code, CI/CD variables, access tokens, and build-pipeline credentials. As a result, organizations operating internet-facing self-managed deployments may face elevated risk if they delay applying the updates.

Additional Enterprise Edition issue fixed

The same releases also address CVE-2026-87719, a CVSS 9.9 insecure deserialization vulnerability affecting GitLab Enterprise Edition. GitLab said an authenticated user with access to Duo Chat could use a crafted GraphQL subscription argument to access Advanced Search instance configuration details and potentially sensitive credentials.

Recommended actions

• Upgrade affected GitLab CE and EE instances to a fixed version as soon as possible.
• Restrict public exposure of self-managed GitLab systems where external access is not necessary.
• Review web and application logs for suspicious POST requests to repository commits API endpoints, particularly requests containing file.Path parameters.
• Assess whether exposed credentials, tokens, or configuration files require rotation.