CVE-2026-85706, GitLab CE/EE: unauthenticated path traversal in the repository commits API reads arbitrary server files, and honeypots recorded probes by the day after the patch (CVSS 10.0)
GitLab's maximum-severity file-read flaw drew in-the-wild probes by the day after its patch
Defender actions
- Upgrade every self-managed GitLab CE/EE instance to 19.3.2 / 19.2.6 / 19.1.8 now, or on the 19.0 and 18.11 trains to the 19.0.9 / 18.11.12 backports, which carry only the CVE-2026-85706 and CVE-2026-87719 fixes and leave GitLab EE exposed to CVE-2026-88765 until 19.1.8 or later; GitLab.com is already patched and GitLab Dedicated needs no action. Assume any files an attacker-scripted request could reach (configuration files, secrets or other sensitive server-side data) may have been read, and rotate them if the instance was internet-reachable and unpatched since 2026-09-10.
Analysis
GitLab's own patch-release notes name the root cause plainly: "improper path confinement and missing authentication enforcement in the repository commits API" let an unauthenticated caller read arbitrary files from the server (GitLab, 2026-09-10). The vulnerability, CVE-2026-85706 (CVSS 10.0, scope-changed, no privileges or user interaction required), affects every self-managed CE/EE release from 18.7 up to 19.1.8, 19.2.6 and 19.3.2, the versions GitLab shipped on 2026-09-10, with backports to 19.0.9 and 18.11.12 following on 2026-09-23; GitLab.com was already running the patched version, and GitLab Dedicated customers need no action. watchTowr warns that the readable files can include configuration files, secrets or other sensitive server-side data, and that GitLab instances often hold source code, credentials and CI/CD configuration data (watchTowr, 2026-09-11); in analyst judgement, that is what turns a file-read primitive into a foothold on the CI/CD and source-control plane GitLab manages. The flaw was reported through GitLab's HackerOne bug-bounty program by researcher s3ntago (GitLab, 2026-09-10).
watchTowr reproduced the vulnerability and validated exposure across client environments, and by 2026-09-11 its Attacker Eye honeypot network was already recording behavioral probes for the vulnerability, which watchTowr reads as attackers having already built an exploit (watchTowr, 2026-09-11). CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-09-11 (CISA KEV, catalogue version 2026.09.11), and NCSC Switzerland's own advisory, published earlier that same day, still recorded exploitation status as "unknown", which shows how fast the status moved within a single day (NCSC Switzerland, 2026-09-11). The same release also fixed CVE-2026-87719 (CVSS 9.9), an insecure GraphQL-subscription deserialization issue that lets an authenticated user with Duo Chat access obtain Advanced Search configurations and credentials (GitLab, 2026-09-10); it is not KEV-listed, and NCSC Switzerland's advisory has since recorded it as exploited too (see the 2026-09-16 update below), though on materially thinner evidence than CVE-2026-85706's own KEV listing and honeypot corroboration.
Cited evidence
GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
watchTowr Intel is already seeing behavioral probes for this vulnerability against Attacker Eye, our global honeypot network, meaning attackers have already successfully reverse engineered and reproduced the vulnerability and the countdown to indiscriminate, in-the-wild exploitation is on.
Defenders should also hunt through log files for HTTP POST requests to “/api/v4/projects/{id}/repository/commits/” URIs containing “file.path” parameters to identify potential exploitation attempts.
CVE-2026-87719 is known as actively exploited
Actively exploited, Proof of Concept available
Updates3
NCSC Switzerland's own advisory, published 2026-09-11, independently confirms CVE-2026-87719 (CVSS 9.9, GitLab EE only) alongside CVE-2026-85706 in the same posting. GitLab's own release notes describe the flaw: "GitLab has remediated an issue that, under certain conditions, could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup" (GitLab, 2026-09-10). Affected versions are EE only, 18.3 up to the same 19.1.8/19.2.6/19.3.2 fixed releases named above; no exploitation is confirmed for this CVE. The same release also fixed CVE-2026-88765 (CVSS 8.5, GitLab EE only, sourced from GitLab's own release notes alone with no independent confirmation found): "GitLab has remediated an issue that, under certain conditions, could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing" (GitLab, 2026-09-10). This flaw's affected-version floor, EE 12.3, is substantially older than the other two flaws in this release, so any EE instance that has deferred upgrades for a long period carries the largest exposure window for this specific remote-code-execution path.
By inference from the mechanism, audit logs for GraphQL subscription requests with abnormal argument shapes targeting Advanced Search, and for an Advanced Search reindex operation immediately following a Git project import from an external or untrusted source, are the discriminators for these two additional flaws.
NCSC Switzerland's Cyber Security Hub posting for this advisory was edited twice more inside this window. On 2026-09-14 the posting's own edit-history record states "CVE-2026-87719 is known as actively exploited" (NCSC Switzerland, 2026-09-14), moving the GitLab EE deserialization flaw from patch-available-only to exploited; that same-day posting carries no further detail on this CVE specifically (no campaign, no named cluster, no second source, and CISA's KEV catalog does not list it) so this status rests on NCSC Switzerland's own brief statement alone rather than the broader corroboration CVE-2026-85706 already carries. On 2026-09-15 the same posting was updated again, its status field now reading "Actively exploited, Proof of Concept available" for CVE-2026-85706 (NCSC Switzerland, 2026-09-15), and linking a public working proof of concept whose repository dates from 2026-09-11 (guneykabel, 2026-09-11). No new affected-version information accompanies either update; GitLab 19.3.2/19.2.6/19.1.8 remain the fixed releases for both CVEs.
Any self-managed instance still unpatched should now be treated as likely already probed on both fronts: the file-read path with a public exploit script circulating, and, for any instance with Duo Chat-enabled accounts, the Advanced Search credential-exposure path CVE-2026-87719 opens.
On 2026-09-23 GitLab released 19.0.9 and 18.11.12, backporting the fixes for CVE-2026-85706 and CVE-2026-87719 to self-managed installations that cannot immediately move to 19.1 or later (GitLab, 2026-09-23). Instances on 18.7 to 18.11 or on 19.0 are therefore fixed by 18.11.12 or 19.0.9 rather than only by an upgrade to a newer minor release. GitLab says these versions contain only those security fixes (GitLab, 2026-09-23), so GitLab EE on the backport trains stays exposed to CVE-2026-88765, which is fixed from 19.1.8 (GitLab, 2026-09-10). GitLab has published three detections for CVE-2026-85706 exploitation attempts: reads of gitlab.yml, inclusion through the metadata.path parameter, and file-path enumeration (GitLab, 2026-09-10). NCSC Switzerland's exploited status for CVE-2026-87719 rests on its post's edit history; the update text of the same day concerns CVE-2026-85706's KEV listing (NCSC Switzerland, 2026-09-15).
Sources8
Revision history
- Published 2026-09-12T0409Z-intel
- Update 2026-09-13T0409Z-intel
NCSC Switzerland's own advisory independently confirms CVE-2026-87719 (CVSS 9.9, GitLab EE only), an insecure-deserialization flaw already described in this entry but not previously given its own CVE record; this update adds one, alongside a further EE-only flaw from the same patch release, CVE-2026-88765 (CVSS 8.5, vendor-sourced only), a buffer overflow reachable via a crafted Git project import.
Changed: cves tags body
- Update 2026-09-16T0409Z-intel
NCSC Switzerland's Cyber Security Hub posting for this advisory was edited twice more this window: on 2026-09-14 recording CVE-2026-87719 as now actively exploited, and on 2026-09-15 adding a public working proof-of-concept for the original CVE-2026-85706 path-traversal flaw.
Changed: cves tags actions sources evidence body
- Update 2026-10-11T1307Z-audit
GitLab released 19.0.9 and 18.11.12 on 2026-09-23, backporting the fixes for the exploited CVE-2026-85706 and CVE-2026-87719 to self-managed installations that cannot move to 19.1 or later; the affected and fixed versions, the summary and the patch action now include both backport trains, and the action notes that the backports leave CVE-2026-88765 open on GitLab EE. The watchTowr sentence on readable files and the Triage line now say only what watchTowr says. A KEV remediation-deadline mention is dropped from the main text. The patch action now names only what watchTowr says a request could read, GitLab's three exploitation-attempt detections are named, and the CVE-2026-87719 exploited status is attributed to NCSC Switzerland's advisory history, whose update text of that day concerns CVE-2026-85706. The foothold reading is marked as analyst judgement, and the hunting action that restated the body is dropped.
Changed: cves sources body summary actions title headline
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.