Loading story…
GitLab patched CVE-2026-85706, a CVSS 10.0 vulnerability in the repository commits API that lets unauthenticated remote attackers bypass path restrictions and read arbitrary files from vulnerable self-managed GitLab CE and EE servers. CISA added the flaw to its Known Exploited Vulnerabilities catalog, while public proof-of-concept material, Nuclei templates, scanning, and attempted exploitation have increased the risk that exposed instances could leak secrets, CI/CD credentials, and deployment material.
Organizations should urgently upgrade to GitLab versions 19.1.8, 19.2.6, or 19.3.2, as applicable, and review API request logs for traversal attempts against commit endpoints. The releases also remediate critical flaws including CVE-2026-87719, an authenticated GitLab EE Duo Chat unsafe-deserialization issue, alongside other high-severity bugs that can enable remote code execution, configuration changes, CI/CD-variable access, denial of service, or GraphQL authorization and CSRF attacks; defenders should treat a GitLab compromise as a potential software supply-chain incident.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Scanning for vulnerable GitLab servers reportedly began on September 11, with exploitation following within hours of disclosure. The flaw could allow an unauthenticated attacker to read arbitrary files through traversal payloads in repository-commit API requests.
CISA reportedly added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog after the GitLab repository commits API flaw was found to be actively exploited.
GitLab reportedly issued out-of-band updates for CVE-2026-85706, a CVSS 10.0 unauthenticated path-traversal flaw in the repository commits API, and CVE-2026-87719, an unsafe deserialization issue in GitLab EE Duo Chat. The updates also addressed six high-severity vulnerabilities; CVE-2026-85706 was fixed in versions 19.1.8, 19.2.6, and 19.3.2.
Honeypot systems reportedly observed exploitation attempts targeting the GitLab GraphQL vulnerability CVE-2026-19478.
WatchTowr reportedly reproduced CVE-2026-19478, demonstrating that improper validation of GraphQL directives could permit authorization bypass and anonymous mutations against public resources.
GitLab reportedly released out-of-band fixes for CVE-2026-19478, an unauthenticated GraphQL authorization-bypass flaw, and CVE-2026-19650, a GraphQL CSRF vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released versions **19.3.2**, **19.2.6**, and **19.1.8** for Community Edition and Enterprise Edition, remediating 18 vulnerabilities. The most severe, **CVE-2026-85706** (CVSS 10.0), is an unauthenticated path-traversal flaw in the repository commits API that enables arbitrary file reads from vulnerable GitLab servers. GitLab also addressed authorization issues, cross-site scripting, CI/CD-variable exposure, and denial-of-service vulnerabilities. Enterprise Edition fixes include **CVE-2026-87719** (CVSS 9.9), an authenticated insecure-deserialization issue associated with Duo Chat/GraphQL subscription handling that can expose Advanced Search configuration and credentials, and **CVE-2026-88765** (CVSS 8.5), which can allow authenticated remote code execution through importing a crafted malicious Git project export. GitLab.com already runs the patched release and GitLab Dedicated customers need take no action; self-managed administrators should upgrade immediately and plan for database migrations, which require downtime on single-node deployments.
Sep 18, 2026
GitLab released patched Community Edition and Enterprise Edition versions `19.2.2`, `19.1.4`, and `19.0.6` to fix multiple security issues and urged self-managed customers to upgrade immediately. The update addresses high-, medium-, and low-severity vulnerabilities, including cross-site scripting, improper authorization, denial of service, and privilege assignment flaws. GitLab said GitLab.com was already running the fixed version, while GitLab Dedicated customers did not need to take action; the release also includes database migrations that may cause downtime for single-node instances during upgrade. The most severe issues include two high-severity XSS flaws in analytics dashboard components, tracked as **CVE-2026-15216** and **CVE-2026-15217**, each with a CVSS score of `8.7`, affecting GitLab CE/EE versions from `18.2` before `19.0.6`, `19.1` before `19.1.4`, and `19.2` before `19.2.2`. GitLab also fixed **CVE-2026-19228**, an authorization bypass issue in GitLab EE with a CVSS score of `8.5`, affecting `19.1` before `19.1.4` and `19.2` before `19.2.2`, which could let an authenticated user cause AI usage to be attributed to another namespace under certain conditions.
Aug 31, 2026
GitLab released **19.0.2**, **18.11.5**, and **18.10.8** for self-managed Community Edition and Enterprise Edition deployments to fix **11 security vulnerabilities** and additional bugs, and urged administrators to upgrade immediately. The advisory says all versions before those releases are affected, while **GitLab.com** has already been patched and **GitLab Dedicated** customers do not need to take action. GitLab also warned that the update includes database migrations that may cause downtime on single-node instances, though multi-node environments can use zero-downtime upgrade procedures. The most severe issue, **`CVE-2026-6552`** (**CVSS 8.7**), is an improper authorization flaw in GitLab EE's Group SAML identity management that could let an authenticated **group Owner** take over another group member's account under certain conditions. GitLab also fixed **`CVE-2026-10087`**, an Analytics Dashboard cross-site scripting flaw in GitLab EE that could allow an authenticated **developer** to execute arbitrary client-side code in a victim's browser. The broader patch set addresses additional risks including denial of service in Grape API JSON parsing, SSRF, unauthorized access to confidential data, and other authorization bypasses, and government and vendor advisories have called on organizations to apply the patched versions.
Jul 25, 2026