Perfect-10 GitLab bug under attack days after patch lands
CISA confirms active exploitation as watchTowr spots miscreants probing internet-facing servers
A critical GitLab vulnerability, CVE-2026-85706, is being actively exploited by cyber attackers, according to the US Cybersecurity and Infrastructure Security Agency (CISA). The flaw, a path traversal bug in the repository commits API, allows unauthenticated attackers to read arbitrary files from vulnerable servers. GitLab has rated this vulnerability a perfect 10.0 on the CVSS v3.1 severity scale.
The issue stems from improper path confinement and missing authentication enforcement in the affected API. GitLab released patches for versions 19.3.2, 19.2.6 and 19.1.8 on September 10, urging operators of affected self-managed installations to upgrade immediately. GitLab.com is already patched, while GitLab Dedicated customers do not need to take action.
Security firm watchTowr observed probes for the vulnerability in the wild and warned that widespread exploitation is likely. Exploiting the flaw can be as simple as sending a single HTTP request, potentially granting attackers access to local files, configuration data, credentials and other secrets. CISA cautioned that while BOD 26-04 applies to Federal Contracting Executive Board agencies, it encourages all organizations to prioritize remediation of Known Exploited Vulnerabilities Catalog (KEV) vulnerabilities.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
