Git Lab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
Summary: GitLab patched CVE-2026-85706, a CVSS 10.0 path traversal flaw in the repository commits API that lets an unauthenticated user read arbitrary files from the server under certain conditions, with in-the-wild probes observed from 06:00 UTC on September 11, 2026. CISA added the flaw to its KEV catalog the same day, requiring FCEB agencies to apply fixes by September 14, 2026, and GitLab also patched a CVSS 9.9 insecure deserialization bug in EE (CVE-2026-87719) in versions 19.3.2, 19.2.6, and 19.1.8.
What you should know: watchTowr reported that exploitation moved from probes to successful exfiltration, with attackers dumping config files for secrets alongside system SSH configurations - a combination that can yield passwords and host access. Exploitation requires only that at least one public project exist, and the prior GitLab GraphQL flaw (CVE-2026-19478) was almost immediately actively exploited.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-19478CVE-2026-85706CVE-2026-87719
- Related
- CVE-2026-85706: Git Lab Community Edition and Enterprise Edition Path Traversal Vulnerability Known Exploited Vulnerabilities · Sep 11, 2026