Critical GitLab Path Traversal (CVE-2026-85706) Under Active Exploitation Following Disclosure

Executive Summary

On September 10, 2026, GitLab released a critical security patch addressing CVE-2026-85706, a path traversal vulnerability in its repository commits API. With a CVSSv3.1 score of 10.0, the flaw permits unauthenticated remote attackers to read arbitrary files from affected servers. Evidence of active exploitation emerged within 24 hours of disclosure, leading the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026.

Threat Analysis

The vulnerability stems from improper path confinement and a lack of authentication enforcement within the repository commits API. By sending a single, specially crafted HTTP request, an attacker can bypass security controls to access sensitive files. This exposure is particularly dangerous as it can reveal SSH keys, database credentials, CI/CD variables, and deployment tokens, providing a roadmap for further lateral movement and full system compromise.

Technical Details

CVE-2026-85706 (CWE-22) affects GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows an attacker to traverse the directory structure of the host server. Because the API endpoint does not properly validate input or enforce authentication, the attacker can retrieve files outside the intended repository scope. Security researchers at watchTowr and Rapid7 have confirmed that automated scanning and exploitation attempts were observed globally shortly after the patch was released, indicating that threat actors quickly weaponized the proof-of-concept code.

Attribution Assessment

While specific threat actor attribution remains ongoing, the speed of exploitation suggests the involvement of sophisticated cyber-espionage groups or financially motivated actors who monitor vulnerability disclosures for immediate weaponization. The nature of the data exposed—specifically CI/CD variables and deployment tokens—is highly characteristic of actors seeking to compromise software supply chains.

Implications

Organizations running self-hosted GitLab instances are at immediate risk. Successful exploitation grants attackers the ability to exfiltrate intellectual property, source code, and infrastructure secrets. This could lead to secondary attacks, including the injection of malicious code into software build pipelines, potentially affecting the downstream customers of the compromised organization.

Recommendations

1. Immediate Patching: Organizations must update all GitLab CE/EE instances to the latest patched version immediately.
2. Credential Rotation: If a server was exposed prior to patching, assume that all secrets, SSH keys, and tokens stored within the GitLab environment have been compromised. Rotate all credentials immediately.
3. Audit Logs: Review server access logs for suspicious requests to the repository commits API originating from unknown or unauthorized IP addresses.
4. Network Segmentation: Ensure that GitLab instances are not exposed to the public internet unless strictly necessary, and utilize WAF rules to block suspicious path traversal patterns.