Loading story…
GitLab released versions 19.3.2, 19.2.6, and 19.1.8 for Community Edition and Enterprise Edition, remediating 18 vulnerabilities. The most severe, CVE-2026-85706 (CVSS 10.0), is an unauthenticated path-traversal flaw in the repository commits API that enables arbitrary file reads from vulnerable GitLab servers. GitLab also addressed authorization issues, cross-site scripting, CI/CD-variable exposure, and denial-of-service vulnerabilities.
Enterprise Edition fixes include CVE-2026-87719 (CVSS 9.9), an authenticated insecure-deserialization issue associated with Duo Chat/GraphQL subscription handling that can expose Advanced Search configuration and credentials, and CVE-2026-88765 (CVSS 8.5), which can allow authenticated remote code execution through importing a crafted malicious Git project export. GitLab.com already runs the patched release and GitLab Dedicated customers need take no action; self-managed administrators should upgrade immediately and plan for database migrations, which require downtime on single-node deployments.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
CISA required U.S. federal civilian executive branch agencies to remediate actively exploited GitLab CVE-2026-85706 and designated affected instances for forensic triage under Binding Operational Directive 26-04. The directive notes that pre-patch access may have exposed source code, CI/CD data, credentials, tokens, and other secrets.
CISA added GitLab CVE-2026-85706 to its Known Exploited Vulnerabilities Catalog after exploitation was observed. The Canadian Centre for Cyber Security advised GitLab administrators to apply the vendor's required updates promptly.
WatchTowr observed in-the-wild probes targeting GitLab CVE-2026-85706 one day after the vulnerability's public disclosure. The researchers warned that mass exploitation of the unauthenticated path-traversal flaw was likely to follow.
GitLab released versions 19.3.2, 19.2.6, and 19.1.8 for Community Edition and Enterprise Edition, remediating 18 vulnerabilities. The fixes include CVE-2026-85706, a CVSS 10.0 unauthenticated repository-commits API path traversal that could permit arbitrary file reads; GitLab advised affected self-managed customers to upgrade immediately.
A ProjectDiscovery Nuclei template named "cve-2026-85706-nuclei-probe" was proposed to test GitLab instances for unauthenticated file-read behavior associated with CVE-2026-85706. The probe uses URL-escaped route components such as `%66iles`, `%63ommits`, and `%72epository`, and checks for the "local file not present" response marker.
GitLab disclosed CVE-2026-87719, a critical unsafe-deserialization vulnerability in the GitLab EE GraphQL subscription serializer. Authenticated users with Duo Chat access could obtain sensitive credentials and Advanced Search instance configuration; GitLab released updates for self-managed deployments, while GitLab.com was already patched and GitLab Dedicated was unaffected.
WatchTowr recommended that defenders review HTTP POST requests to `/api/v4/projects/{id}/repository/commits/` containing `file.Path` parameters as possible indicators of CVE-2026-85706 exploitation. The researchers also noted exploitation requires at least one public GitLab project.
WatchTowr stated that CVE-2026-19478, an unauthenticated GitLab GraphQL flaw that could modify or delete public project and user data, experienced active exploitation shortly after disclosure. GitLab had previously issued fixes in CE/EE versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
26 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcedocs.gitlab.com
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released patched Community Edition and Enterprise Edition versions `19.2.2`, `19.1.4`, and `19.0.6` to fix multiple security issues and urged self-managed customers to upgrade immediately. The update addresses high-, medium-, and low-severity vulnerabilities, including cross-site scripting, improper authorization, denial of service, and privilege assignment flaws. GitLab said GitLab.com was already running the fixed version, while GitLab Dedicated customers did not need to take action; the release also includes database migrations that may cause downtime for single-node instances during upgrade. The most severe issues include two high-severity XSS flaws in analytics dashboard components, tracked as **CVE-2026-15216** and **CVE-2026-15217**, each with a CVSS score of `8.7`, affecting GitLab CE/EE versions from `18.2` before `19.0.6`, `19.1` before `19.1.4`, and `19.2` before `19.2.2`. GitLab also fixed **CVE-2026-19228**, an authorization bypass issue in GitLab EE with a CVSS score of `8.5`, affecting `19.1` before `19.1.4` and `19.2` before `19.2.2`, which could let an authenticated user cause AI usage to be attributed to another namespace under certain conditions.
Aug 31, 2026
GitLab released patch versions **18.6.2**, **18.5.4**, and **18.4.6** for GitLab Community Edition and Enterprise Edition to fix multiple security flaws affecting self-managed deployments. The company said **GitLab.com** was already patched and **GitLab Dedicated** customers did not need to take action, while administrators running affected self-managed versions were urged to upgrade immediately. The fixes were tied to several CVE records, including `CVE-2025-12029`, `CVE-2025-12716`, `CVE-2025-8405`, and `CVE-2025-11984`. The patched issues included several **high-severity** vulnerabilities, such as cross-site scripting in Wiki and Swagger UI, improper encoding in vulnerability reports, and a denial-of-service condition in GraphQL endpoints. GitLab also addressed medium- and low-severity flaws involving WebAuthn, ExifTool processing, the Commit API, compliance frameworks, error messages, and merge request titles. The release included database migrations that could cause downtime on single-node deployments, although multi-node environments could use GitLab's zero-downtime upgrade procedures.
Jul 24, 2026
GitLab released **19.1.2**, **19.0.4**, and **18.11.7** to fix eight security vulnerabilities in GitLab Community Edition and Enterprise Edition, including two high-severity script-injection issues. One of the disclosed flaws, **`CVE-2026-6896`**, is a **CWE-79** cross-site scripting vulnerability in GitLab EE that could let an authenticated user with **Developer** privileges execute arbitrary script in another user’s browser under certain conditions. The issue affects releases from **13.11** before **18.11.7**, **19.0** before **19.0.4**, and **19.1** before **19.1.2**. The patch set also addresses a medium-severity credential exposure issue and several authorization and access-control weaknesses. GitLab said **GitLab.com** was already patched and **GitLab Dedicated** customers do not need to take action, but urged operators of self-managed instances on affected versions to upgrade immediately. The release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid interruption by following GitLab’s zero-downtime upgrade procedures.
Jul 9, 2026