NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

GitLab CE/EE file-read flaw CVE-2026-85706 exploited; fixes and older-branch backports available

Attackers have exploited a GitLab flaw that lets them read server files without logging in. Organisations hosting GitLab themselves should update and investigate possible exposure. GitLab.com and GitLab Dedicated are patched.

What to do

GitLab.com and GitLab Dedicated users have nothing to update for this flaw because GitLab has patched those services. If your business hosts GitLab itself, ask IT to install the latest patch on a supported branch; the first fixes were 19.3.2, 19.2.6 and 19.1.8, with later backports 19.0.9 and 18.11.12. Ask IT to preserve logs before restarting, investigate disclosure using GitLab's guidance and replace any exposed credentials.

What’s happening

CVE-2026-85706 affects GitLab Community Edition and Enterprise Edition servers that organisations operate themselves. Missing access checks and incorrect file-path restrictions in the repository commits API can let someone read server files without signing in. GitLab rates it critical, with a CVSS score of 10.0. Fixes arrived on 10 September, and CISA confirmed exploitation the next day. GitLab added fixes for older 18.11 and 19.0 installations on 23 September. All affected supported branches have fixes; unsupported 18.7–18.10 branches have no fixed build and require an upgrade. GitLab.com and GitLab Dedicated are patched. Updating prevents further exploitation but does not resolve any earlier disclosure. GitLab's investigation guidance distinguishes attempted access from actual disclosure and recommends replacing credentials shown to have leaked. The reviewed sources do not establish how many organisations lost data or that attacks have ended.

What
Flaw
Affects
GitLab Community Edition and Enterprise Edition
Affected
GitLab CE/EE: all versions from 18.7 before 18.11.12
GitLab CE/EE: 19.0 before 19.0.9
GitLab CE/EE: 19.1 before 19.1.8
GitLab CE/EE: 19.2 before 19.2.6
GitLab CE/EE: 19.3 before 19.3.2
Fixed in
GitLab CE/EE 18.11.12
GitLab CE/EE 19.0.9
GitLab CE/EE 19.1.8
GitLab CE/EE 19.2.6
GitLab CE/EE 19.3.2
CVE
CVE-2026-85706
Since
10 Sept 2026
Closed
8 Oct 2026

Timeline

  1. Vendor revised

    GitLab updated its investigation guidance: a request that reads a file does not necessarily disclose its contents. Administrators should preserve logs before restarting and examine what was actually returned before deciding which credentials to replace.

  2. New fix

    GitLab released 19.0.9 and 18.11.12, bringing the fix to two older branches outside its normal maintenance policy.

  3. CISA added

    CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. It required affected US federal civilian agencies to remediate by 14 September.

  4. Made publicFixed

    GitLab disclosed CVE-2026-85706 and released CE/EE 19.3.2, 19.2.6 and 19.1.8. The flaw lets someone read server files without logging in; GitLab.com was already patched and GitLab Dedicated customers needed no action.

Sources

  1. GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8GitLab · 10 Sept 2026
  2. GitLab Critical Patch Release: 19.0.9, 18.11.12GitLab · 23 Sept 2026
  3. Validating whether a file was actually exfiltrated via CVE-2026-85706 using Workhorse written_bytesGitLab · 8 Oct 2026
  4. GitLab release and maintenance policyGitLab
  5. CVE-2026-85706: Critical GitLab Path Traversal Exploited in the WildRapid7 · 14 Sept 2026
  6. GitLab urges users to patch max severity path traversal flawBleepingComputer · 11 Sept 2026
  7. GitLab CVE-2026-85706: Four Lines Still Without a Fixendoflife.ai · 18 Oct 2026
  8. Over 1,000 GitLab servers vulnerable to ongoing RCE attacksBleepingComputer · 2 Nov 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from September 2026 · JSON · RSS