Fixing and finding [Jump to remediation plan](#remediation) CVE ID # CVE-2026-85706 Published 2026-09-12 Updated last month Vendor/s GitLab Product/s Community Edition and Enterprise Edition Version/s 18.7.0 > 18.11.12 KEV Status Active Exploitation Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild. CVSS Score (v3.1) 10 / 10 Critical Severity Details Base score 10 Critical Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed Confidentiality High Integrity High Availability None Table of Contents [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) ## Description CVE-2026-85706 is a critical CVSS 10.0 unauthenticated file read vulnerability in GitLab CE/EE versions 18.7 to 19.3.2, currently under active exploitation. ## Why this matters "CVE-2026-85706 is a critical vulnerability in GitLab CE/EE with a maximum CVSS score of 10.0. This flaw allows unauthenticated remote attackers to read arbitrary files from the GitLab server, potentially exposing sensitive configuration data, secrets, and source code. Its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog confirms active exploitation in the wild. Because the attack requires no authentication and can be executed over the network, it poses a severe risk to any internet-facing GitLab instance, necessitating immediate remediation to prevent data exfiltration." ## CPE GitLab | Product | Version Start | Version End (excl.) | Status | | ------- | ------------- | ------------------- | ---------- | | gitlab | 18.7.0 | 18.11.12 | vulnerable | | gitlab | 18.7.0 | 18.11.12 | vulnerable | | gitlab | 19.0.0 | 19.0.9 | vulnerable | | gitlab | 19.0.0 | 19.0.9 | vulnerable | | gitlab | 19.1.0 | 19.1.8 | vulnerable | | gitlab | 19.1.0 | 19.1.8 | vulnerable | | gitlab | 19.2.0 | 19.2.6 | vulnerable | | gitlab | 19.2.0 | 19.2.6 | vulnerable | | gitlab | 19.3.0 | 19.3.2 | vulnerable | | gitlab | 19.3.0 | 19.3.2 | vulnerable | ## Related weakness (CWE) CWE-22 ## Remediation plan 1 ### Apply official patches GitLab has released security updates to address this vulnerability. Administrators should immediately apply the security patches for GitLab Community Edition (CE) and Enterprise Edition (EE) provided in versions 19.1.8, 19.2.6, and 19.3.2. 2 ### Update affected systems Verify your current GitLab version. If running versions 18.7 through 19.1.7, 19.2.0 through 19.2.5, or 19.3.0 through 19.3.1, upgrade to the respective fixed versions: 19.1.8, 19.2.6, or 19.3.2 or later. 3 ### Restrict access Limit exposure by placing GitLab instances behind a VPN or restricting API access via firewall rules. Implement Web Application Firewall (WAF) rules to block common path traversal patterns (e.g., ../) targeting the repository commits API endpoint. 4 ### Monitor for exploitation Conduct a forensic review of GitLab access logs for unauthorized access to the repository commits API. Look for unauthenticated requests and indicators of directory traversal, such as encoded slashes or attempts to access sensitive system files like /etc/passwd. ## Detection Guidance "Monitor GitLab's 'production\_json.log' and web server logs for suspicious GET requests to the '/api/v4/projects/:id/repository/commits' endpoint. Look for path traversal sequences like '..%2F' or '../' in the URI. High-frequency unauthenticated API calls resulting in 200 OK responses from this endpoint are strong indicators of compromise. Additionally, deploy WAF signatures that detect CWE-22 patterns specifically targeting GitLab API structures." ## References [https://gitlab.com/gitlab-org/gitlab/-/work\_items/627748 Broken Link ](https://gitlab.com/gitlab-org/gitlab/-/work_items/627748)[https://hackerone.com/reports/3909881 Permissions Required ](https://hackerone.com/reports/3909881)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-85706 Third Party Advisory US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706) ## Sources NIST National Vulnerability Database (NVD) CISA Known Exploited Vulnerabilities (KEV) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](https://www.upguard.com/contact-sales) [Free trial](https://www.upguard.com/demo)