GitLab CVE-2026-85706: Active Scanning Targeting Pre-Authentication File Read

GitLab has advised users to apply a critical security patch to protect against a recently disclosed vulnerability CVE-2026-85706. This flaw is a path traversal issue in the commit API of self-hosted GitLab installations that allows attackers to read files on the server without authentication.

The vulnerability can be exploited by scanning for public-facing self-hosted GitLab instances and sending unauthenticated requests to the commit API with a manipulated file.path parameter that specifies an unauthorized file path. If the conditions are met, the attacker can obtain sensitive information contained in the read files, such as tokens and credentials.

If the attacker successfully obtains valid credentials, they could potentially gain unauthorized access to the GitLab instance or integrated services. Although no confirmed successful attacks have been publicly reported, active scanning attempts were observed shortly after the vulnerability disclosure.

To mitigate the risk, affected GitLab users should update their installations to the patched versions 19.1.8, 19.2.6, or 19.3.2, depending on the series. Administrators should monitor for anomalous unauthenticated POST requests to the commit API and investigate any potential sensitive information leaks that may have occurred during the exposure period.