Loading story…
GitLab Community Edition (CE) and Enterprise Edition (EE) updates address seven vulnerabilities, including the critical path-traversal flaw CVE-2026-85706 and two critical CI/CD code-execution vulnerabilities, CVE-2026-89078 and CVE-2026-93577. CVE-2026-85706 has a CVSS score of 10.0 and allows an unauthenticated remote attacker to read arbitrary files through the repository commits API because of improper path confinement and missing authentication enforcement. FortiGuard reported exploitation attempts across multiple countries and sectors, while CISA added the flaw to its Known Exploited Vulnerabilities catalog.
The two CVSS 9.9 CI/CD flaws can allow an authenticated user to execute arbitrary code on the GitLab server under certain conditions using specially crafted regular expressions in CI/CD configuration. Self-managed GitLab administrators should upgrade immediately: versions 19.2 should move to 19.2.7 or later, 19.3 to 19.3.3 or later, and 19.4 to 19.4.1 or later; earlier fixes for CVE-2026-85706 were released in 19.1.8, 19.2.6, and 19.3.2. Organizations should also review repository commits API logs for suspicious requests, particularly attempts to retrieve configuration or credential files.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog.
GitLab released versions 19.1.8, 19.2.6, and 19.3.2 to remediate CVE-2026-85706, a CVSS 10.0 unauthenticated path-traversal vulnerability in the repository commits API that could expose arbitrary files.
CERT-PY identified CVE-2026-89078 and CVE-2026-93577 as CVSS 9.9 GitLab CE/EE flaws. An authenticated user could submit specially crafted regular expressions through CI/CD configurations to achieve arbitrary code execution on the GitLab server under certain conditions.
GitLab released security updates addressing seven GitLab CE/EE vulnerabilities, including two critical and one high-severity issue, with information-disclosure and remote-code-execution impact. Affected versions include 19.2 releases before 19.2.7, 19.3 releases before 19.3.3, 19.4 releases before 19.4.1, and certain versions dating back to 13.11.
FortiGuard Labs observed attacks targeting CVE-2026-85706 across multiple countries and sectors, including targeting in Italy, Indonesia, Belarus, South Korea, and Germany. Public exploit and proof-of-concept material had also emerged.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
cert.gov.py
Open sourceacn.gov.it
Open sourcegitlab.com
Open sourcegitlab.com
Open sourcecsirt.bj
Open sourcemeetcyber.net
Open sourcefortiguard.fortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released versions **19.3.2**, **19.2.6**, and **19.1.8** for Community Edition and Enterprise Edition, remediating 18 vulnerabilities. The most severe, **CVE-2026-85706** (CVSS 10.0), is an unauthenticated path-traversal flaw in the repository commits API that enables arbitrary file reads from vulnerable GitLab servers. GitLab also addressed authorization issues, cross-site scripting, CI/CD-variable exposure, and denial-of-service vulnerabilities. Enterprise Edition fixes include **CVE-2026-87719** (CVSS 9.9), an authenticated insecure-deserialization issue associated with Duo Chat/GraphQL subscription handling that can expose Advanced Search configuration and credentials, and **CVE-2026-88765** (CVSS 8.5), which can allow authenticated remote code execution through importing a crafted malicious Git project export. GitLab.com already runs the patched release and GitLab Dedicated customers need take no action; self-managed administrators should upgrade immediately and plan for database migrations, which require downtime on single-node deployments.
Sep 18, 2026
GitLab patched **CVE-2026-85706**, a CVSS 10.0 vulnerability in the repository commits API that lets unauthenticated remote attackers bypass path restrictions and read arbitrary files from vulnerable self-managed GitLab CE and EE servers. CISA added the flaw to its Known Exploited Vulnerabilities catalog, while public proof-of-concept material, Nuclei templates, scanning, and attempted exploitation have increased the risk that exposed instances could leak secrets, CI/CD credentials, and deployment material. Organizations should urgently upgrade to GitLab versions **19.1.8**, **19.2.6**, or **19.3.2**, as applicable, and review API request logs for traversal attempts against commit endpoints. The releases also remediate critical flaws including **CVE-2026-87719**, an authenticated GitLab EE Duo Chat unsafe-deserialization issue, alongside other high-severity bugs that can enable remote code execution, configuration changes, CI/CD-variable access, denial of service, or GraphQL authorization and CSRF attacks; defenders should treat a GitLab compromise as a potential software supply-chain incident.
Sep 19, 2026
GitLab released patched Community Edition and Enterprise Edition versions `19.2.2`, `19.1.4`, and `19.0.6` to fix multiple security issues and urged self-managed customers to upgrade immediately. The update addresses high-, medium-, and low-severity vulnerabilities, including cross-site scripting, improper authorization, denial of service, and privilege assignment flaws. GitLab said GitLab.com was already running the fixed version, while GitLab Dedicated customers did not need to take action; the release also includes database migrations that may cause downtime for single-node instances during upgrade. The most severe issues include two high-severity XSS flaws in analytics dashboard components, tracked as **CVE-2026-15216** and **CVE-2026-15217**, each with a CVSS score of `8.7`, affecting GitLab CE/EE versions from `18.2` before `19.0.6`, `19.1` before `19.1.4`, and `19.2` before `19.2.2`. GitLab also fixed **CVE-2026-19228**, an authorization bypass issue in GitLab EE with a CVSS score of `8.5`, affecting `19.1` before `19.1.4` and `19.2` before `19.2.2`, which could let an authenticated user cause AI usage to be attributed to another namespace under certain conditions.
Aug 31, 2026