widely-deployed-product-advisoryinternet-facing-service-vulnerabilitycloud-service-vulnerabilitybuild-pipeline-compromise

GitLab Patches CVSS 10 Path Traversal and Enterprise RCE Flaws

Patch & Detection Intelligence · 69 sources · Updated 2mo ago · First seen Sep 11, 2026

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 for Community Edition and Enterprise Edition, remediating 18 vulnerabilities. The most severe, CVE-2026-85706 (CVSS 10.0), is an unauthenticated path-traversal flaw in the repository commits API that enables arbitrary file reads from vulnerable GitLab servers. GitLab also addressed authorization issues, cross-site scripting, CI/CD-variable exposure, and denial-of-service vulnerabilities.

Enterprise Edition fixes include CVE-2026-87719 (CVSS 9.9), an authenticated insecure-deserialization issue associated with Duo Chat/GraphQL subscription handling that can expose Advanced Search configuration and credentials, and CVE-2026-88765 (CVSS 8.5), which can allow authenticated remote code execution through importing a crafted malicious Git project export. GitLab.com already runs the patched release and GitLab Dedicated customers need take no action; self-managed administrators should upgrade immediately and plan for database migrations, which require downtime on single-node deployments.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

26 events · Sep 10, 2026 – Sep 16, 2026

Reported Sep 17, 20262mo ago
FortiGuard observes global CVE-2026-85706 attacks and releases IPS signature
FortiGuard Labs observed exploitation attempts targeting GitLab CVE-2026-85706 during the preceding seven days across multiple countries and sectors, with Belarus, South Korea, Germany, China, and Thailand among the most targeted locations. FortiGuard made IPS signature 62167 available to detect and block network-based exploitation attempts.
Threat Signal Report | FortiGuard Labs
Reported Sep 16, 20262mo ago
Tenable provides Nessus plugin for CVE-2026-85706
Tenable documented the Nessus plugin `gitlab_cve-2026-85706.nasl` for identifying GitLab installations affected by CVE-2026-85706. The check uses the `installed_sw/GitLab` knowledge-base item and classifies the issue in the CGI abuses family.
GitLab 18.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026... | Tenable®
Sep 16, 20262mo ago
GitLab patches CVE-2026-16794 compliance framework authorization flaw
GitLab remediated CVE-2026-16794, an improper-authorization vulnerability in GitLab EE compliance framework management. Under certain conditions, an authenticated Security Manager could execute arbitrary CI/CD jobs and access protected variables in group projects; no known exploits were reported.
GitLab 18.11 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-202... | Tenable®
Sep 16, 20262mo ago
GitLab patches CVE-2026-8030 namespace-transfer validation flaw
GitLab remediated CVE-2026-8030, an improper-validation flaw involving group URL slugs during namespace transfers in CE and EE. Under certain conditions, an authenticated user could prevent another user from modifying group settings; the issue was fixed in versions 19.1.8, 19.2.6, and 19.3.2, with no known exploits reported.
GitLab 13.0 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026... | Tenable®
Sep 16, 20262mo ago
GitLab fixes CVE-2026-19619 Content Editor HTML-sanitization XSS flaw
GitLab remediated CVE-2026-19619, an improper HTML-sanitization flaw in the CE/EE Content Editor that could allow an unauthenticated attacker to execute JavaScript in a targeted user's session through pasted HTML content. The flaw was fixed in versions 19.1.8, 19.2.6, and 19.3.2, and no known exploits were reported.
GitLab 19.0 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026... | Tenable®
Sep 16, 20262mo ago
GitLab patches CVE-2026-3855 Terraform state upload flaw
GitLab remediated CVE-2026-3855, an improper-parameter-validation vulnerability in CE/EE Terraform state uploads that could allow an authenticated project-level user to access restricted server files or cause denial of service. The fix was released in versions 19.1.8, 19.2.6, and 19.3.2; no known exploits were reported.
GitLab 18.2.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-20... | Tenable®
Sep 16, 20262mo ago
GitLab patches CVE-2026-86341 CGI-abuse vulnerability
A patch for CVE-2026-86341, a GitLab CGI-abuse vulnerability requiring high privileges and high attack complexity with high integrity impact, was published. The vulnerability was disclosed on September 13, and Tenable reported no known exploits at the time of its plugin information.
GitLab 17.1 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026... | Tenable®
Sep 16, 20262mo ago
GitLab documents CVE-2026-79708 EE CI/CD variable exposure
GitLab documented CVE-2026-79708, an insufficient-scope-validation flaw in GitLab EE that could let a Developer execute a policy test pipeline against group projects and access protected CI/CD variables intended for more privileged roles. The issue was remediated in versions 19.1.8, 19.2.6, and 19.3.2.
CVE-2026-79708 - Incorrect Authorization in GitLab
Sep 16, 20262mo ago
GitLab details CVE-2026-78252 Markdown JSON table XSS flaw
GitLab identified CVE-2026-78252 as an XSS vulnerability in the Markdown JSON table renderer affecting CE and EE. Improper sanitization of user-controlled data could induce a targeted user to perform unintended state-changing HTTP requests; the flaw was remediated in versions 19.1.8, 19.2.6, and 19.3.2.
CVE-2026-78252 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Sep 15, 20262mo ago
GitLab patches CVE-2026-13210 CGI-abuse vulnerability
A patch was published for CVE-2026-13210, a network-accessible GitLab CGI-abuse-family flaw requiring low privileges that could have high confidentiality impact. Tenable reported no known public exploits and documented Nessus plugin gitlab_cve-2026-13210.nasl for detection.
GitLab 15.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026... | Tenable®
Sep 15, 20262mo ago
GitLab patches CVE-2026-82837 internal data-emission authorization flaw
GitLab remediated CVE-2026-82837, an improper-authorization issue in internal data-emission endpoints that could allow an authenticated user to access sensitive credentials and tokens without using the expected proxy. The issue was fixed in versions 19.1.8, 19.2.6, and 19.3.2; no known exploits were reported.
GitLab 10.1.0 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-20... | Tenable®
Sep 15, 20262mo ago
GitLab patches CVE-2026-12910 CGI-abuse vulnerability
A patch was published for CVE-2026-12910, a GitLab CGI-abuse-family vulnerability requiring low privileges that can cause limited confidentiality and integrity impact. Tenable reported no known exploits for the issue.
GitLab 18.6 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026... | Tenable®
Reported Sep 14, 20262mo ago
Public exploit PoC reported for GitLab CVE-2026-85706
Finland's National Cyber Security Centre reported that public proof-of-concept exploit code is available for the actively exploited CVE-2026-85706 GitLab unauthenticated directory-traversal vulnerability.
Kriittinen haavoittuvuus GitLab Community Edition- ja Enterprise Edition -tuotteissa | Traficom
Sep 13, 20262mo ago
GitLab discloses CVE-2026-1168 GraphQL complexity DoS flaw
GitLab disclosed CVE-2026-1168, an unauthenticated denial-of-service vulnerability in CE and EE caused by insufficient resource-allocation limits in GraphQL complexity calculation. The issue affects versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2; it was remediated in versions 19.1.8, 19.2.6, and 19.3.2, with no known exploits reported.
GitLab 18.4.6 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-20... | Tenable®
Sep 13, 20262mo ago
GitLab discloses CVE-2026-7514 Generic Package Registry authorization flaw
GitLab published CVE-2026-7514, an improper-authorization vulnerability in the CE/EE Generic Package Registry. An authenticated Developer-role user could substitute package-file content or hide packages from their owners; the issue was remediated in versions 19.1.8, 19.2.6, and 19.3.2, with no known public exploits reported.
GitLab 13.9 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026... | Tenable®
Sep 13, 20262mo ago
FreeBSD publishes GitLab security advisory and package patch
FreeBSD published advisory 7fd351d1-af26-11f1-a883-2cf05da270f3 and updates for vulnerable GitLab CE and EE packages. The advisory covers 18 vulnerabilities, including actively exploited CVE-2026-85706 and GitLab EE flaws CVE-2026-87719 and CVE-2026-88765.
FreeBSD : Gitlab -- vulnerabilities (7fd351d1-af26-11f1-a883-2... | Tenable®
Reported Sep 12, 20262mo ago
Nuclei template proposed for CVE-2026-85706 probing
A ProjectDiscovery Nuclei template named "cve-2026-85706-nuclei-probe" was proposed to test GitLab instances for unauthenticated file-read behavior associated with CVE-2026-85706. The probe uses URL-escaped route components such as `%66iles`, `%63ommits`, and `%72epository`, and checks for the "local file not present" response marker.
feat: add CVE-2026-85706 template for GitLab unauthenticated file read by FLX-0x00 · Pull Request #17231 · projectdiscovery/nuclei-templates · GitHub
Reported Sep 11, 20262mo ago
WatchTowr reports exploitation of GitLab CVE-2026-19478
WatchTowr stated that CVE-2026-19478, an unauthenticated GitLab GraphQL flaw that could modify or delete public project and user data, experienced active exploitation shortly after disclosure. GitLab had previously issued fixes in CE/EE versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4.
Max severity GitLab path traversal flaw under active reconnaissance | news | SC Media
Reported Sep 11, 20262mo ago
WatchTowr publishes CVE-2026-85706 hunting indicators
WatchTowr recommended that defenders review HTTP POST requests to `/api/v4/projects/{id}/repository/commits/` containing `file.Path` parameters as possible indicators of CVE-2026-85706 exploitation. The researchers also noted exploitation requires at least one public GitLab project.
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
Sep 11, 20262mo ago
CISA mandates CVE-2026-85706 remediation and forensic triage
CISA required U.S. federal civilian executive branch agencies to remediate actively exploited GitLab CVE-2026-85706 and designated affected instances for forensic triage under Binding Operational Directive 26-04. The directive notes that pre-patch access may have exposed source code, CI/CD data, credentials, tokens, and other secrets.
CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks - Cyber Accord
Sep 11, 20262mo ago
CISA adds CVE-2026-85706 to KEV Catalog
CISA added GitLab CVE-2026-85706 to its Known Exploited Vulnerabilities Catalog after exploitation was observed. The Canadian Centre for Cyber Security advised GitLab administrators to apply the vendor's required updates promptly.
GitLab security advisory (AV26-917) - Canadian Centre for Cyber Security
Sep 11, 20262mo ago
WatchTowr observes probing for CVE-2026-85706
WatchTowr observed in-the-wild probes targeting GitLab CVE-2026-85706 one day after the vulnerability's public disclosure. The researchers warned that mass exploitation of the unauthenticated path-traversal flaw was likely to follow.
GitLab Vulnerability Exploited One Day After Disclosure - SecurityWeek
Reported Sep 10, 20262mo ago
GitLab discloses critical EE GraphQL deserialization flaw
GitLab disclosed CVE-2026-87719, a critical unsafe-deserialization vulnerability in the GitLab EE GraphQL subscription serializer. Authenticated users with Duo Chat access could obtain sensitive credentials and Advanced Search instance configuration; GitLab released updates for self-managed deployments, while GitLab.com was already patched and GitLab Dedicated was unaffected.
GitLab corrige une faille critique de path traversal (CVE-2026-85706) dans l'API commits | CyberVeille
Sep 10, 20262mo ago
GitLab fixes CVE-2026-88765 EE buffer-overflow flaw
GitLab fixed CVE-2026-88765, an authenticated GitLab EE buffer-overflow vulnerability in its Unicode conversion wrapper. An attacker could potentially achieve remote code execution by importing a specially crafted Git project export that is processed during Advanced Search indexing.
GitLab's Worst-Rated Vulnerability Is Already Being Exploited - CySecurity News - Latest Information Security and Hacking Incidents
Sep 10, 20262mo ago
GitLab releases patches for 18 CE and EE vulnerabilities
GitLab released versions 19.3.2, 19.2.6, and 19.1.8 for Community Edition and Enterprise Edition, remediating 18 vulnerabilities. The fixes include CVE-2026-85706, a CVSS 10.0 unauthenticated repository-commits API path traversal that could permit arbitrary file reads; GitLab advised affected self-managed customers to upgrade immediately.
GitLab Patches Critical Flaws Enabling Arbitrary File Read, Credential Theft and Remote Code Execution - Cyber Accord
Date unknown
Velociraptor publishes CVE-2026-85706 GitLab forensic-hunting artifact
A Velociraptor artifact, Linux.Detection.CVE202685706.GitLabFileRead, was published for detecting CVE-2026-85706 exploitation attempts on self-managed GitLab Linux hosts. It analyzes GitLab NGINX and Rails API logs for client-supplied file.path parameters lacking a Workhorse upload token and classifies evidence using response status and response size.
Linux.Detection.CVE202685706.GitLabFileRead

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

18 linked

Unauthenticated Arbitrary File Read in GitLab CE/EE Repository APIs (CVE-2026-85706)Insecure Deserialization in GitLab EE GraphQL Subscriptions (CVE-2026-87719)Authenticated Remote Code Execution in GitLab EE Advanced Search Unicode Conversion (CVE-2026-88765)Credential disclosure in GitLab Workhorse internal data-emission endpoints (CVE-2026-82837)SAML SSO Sign-In Restriction Bypass in GitLab CE/EE (CVE-2026-12910)Protected CI/CD Variable Access via GitLab EE Policy Test Pipelines (CVE-2026-79708)Improper Authorization in GitLab EE Compliance Framework Management (CVE-2026-16794)GitLab Terraform State Upload Improper Input Validation (CVE-2026-3855)GitLab CE/EE Merge Request Pipeline Creation Race Condition (CVE-2024-11222)GitLab Protected Environment Deployment Approval Bypass (CVE-2026-86340)+8 more

Affected products

3 linked

GitlabGitlab Community EditionGitlab Enterprise Edition

Organizations

1 linked

GitLab

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

50 references tracked. Mallory keeps watching after this page renders.

Fortinet Threat SignalNews · Sep 17, 2026

Threat Signal Report | FortiGuard LabsOpen source ↗

Nuclei Templates Pull RequestsNews · Sep 17, 2026

Add CVE-2026-85706 variant detection YAML by comradezephyr · Pull Request #17268 · projectdiscovery/nuclei-templatesOpen source ↗

Cert PyAdvisories · Sep 16, 2026

Vulnerabilidades en productos de GitLab - CERT-PYOpen source ↗

Cvefeed High SeverityAdvisories · Sep 16, 2026

CVE-2026-79708 - Incorrect Authorization in GitLabOpen source ↗

42 additional sources from 12-09-2026 to 16-09-2026

Nuclei Templates Pull RequestsNews · Sep 12, 2026

feat: add CVE-2026-85706 template for GitLab unauthenticated file read by FLX-0x00 · Pull Request #17231 · projectdiscovery/nuclei-templates · GitHubOpen source ↗

Cert SeAdvisories · Sep 11, 2026

GitLab rättar kritiska sårbarheter - CERT-SEOpen source ↗

ScworldNews · Sep 11, 2026

Max severity GitLab path traversal flaw under active reconnaissance | news | SC MediaOpen source ↗

Rapid7 Velociraptor Artifact ExchangeNews

Linux.Detection.CVE202685706.GitLabFileReadOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News