Scanners were hammering GitLab servers within hours of a patch this week, and the bug they are chasing scores a perfect 10.0.
The flaw, CVE-2026-85706, is a path traversal in the API that handles repository commits. Two defects combined to create it: file paths were never confined, and the code skipped authentication checks. The result is that anyone at all, with no account and no credentials, can pull arbitrary files off the server. Logs, secrets, and configuration material are all within reach.
GitLab shipped fixes for Community and Enterprise Edition. There is a low bar for abuse, according to the attack surface firm watchTowr: an instance only needs one public project to be reachable. The company logged the first probes at 06:00 UTC on September 11, the morning after the patch went out, and warned that broad, untargeted sweeps typically follow.
Enterprise Edition carries a second problem as well. CVE-2026-87719, rated 9.9, lets a Duo Chat user hide a command inside a routine request, tricking the server into reading back its own Advanced Search settings, passwords included.
Builds from 18.7 through 19.1.8 are exposed, along with 19.2 before 19.2.6 and 19.3 before 19.3.2. GitLab’s hosted and Dedicated offerings already run fixed code.
Upgrade first, then check logs for POST requests under /api/v4/projects/ that carry a file.path parameter. An unpatched instance facing the open internet is a live target.
