Critical GitLab Path Traversal Vulnerability (CVE-2026-85706) Under Active Exploitation

Executive Summary

On September 10, 2026, GitLab released a critical security patch to address CVE-2026-85706, a path traversal vulnerability affecting both GitLab Community Edition (CE) and Enterprise Edition (EE). With a CVSSv3.1 score of 10.0, this flaw allows unauthenticated attackers to read arbitrary files from affected servers. Evidence of active exploitation in the wild led the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026.

Threat Analysis

The vulnerability exists within the repository commits API. Improper path confinement and a failure to enforce authentication allow remote, unauthenticated actors to bypass security controls. Because the vulnerability is trivial to exploit and does not require prior access, it represents a high-risk vector for data exfiltration, including the theft of sensitive configuration files, environment variables, and source code repositories.

Technical Details

CVE-2026-85706 is classified as a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). By crafting specific requests to the repository commits API, an attacker can manipulate file paths to traverse outside the intended directory structure. This allows the retrieval of files that should be restricted from public or unauthenticated access. Security researchers have confirmed that the exploit does not require complex chaining, making it highly attractive to opportunistic threat actors scanning for vulnerable infrastructure.

Attribution Assessment

While specific threat actor attribution remains under investigation, the rapid weaponization of this vulnerability following disclosure is consistent with the tactics of state-sponsored espionage groups and sophisticated cybercriminal syndicates. The nature of the target—GitLab servers—suggests that attackers are primarily interested in intellectual property theft and gaining a foothold in software development pipelines.

Implications

Organizations running self-hosted GitLab instances are at immediate risk of total information disclosure. Successful exploitation could lead to the compromise of proprietary source code, API keys, and database credentials stored within the GitLab environment. This could facilitate further supply chain attacks or lateral movement within the victim's network.

Recommendations

1. Immediate Patching: Organizations must update all GitLab CE and EE instances to the latest patched versions immediately.
2. Audit Logs: Review server access logs for anomalous requests to the repository commits API, specifically looking for path traversal patterns (e.g., '../').
3. Credential Rotation: If a server is suspected of being compromised, rotate all secrets, API keys, and credentials that were accessible via the GitLab instance.
4. Network Segmentation: Ensure that GitLab instances are not exposed to the public internet unless strictly necessary, and utilize WAF rules to block suspicious API traffic.