GitLab says anyone running its self-managed software should patch immediately because attackers may be able to read files from vulnerable servers without logging in. The main issue, CVE-2026-85706, is a maximum-severity path traversal flaw in the repository commits API caused by improper path confinement and missing authentication enforcement; GitLab also fixed CVE-2026-87719, an insecure deserialization bug in GitLab EE's GraphQL subscription serializer that can let authenticated Duo Chat users steal sensitive credentials and Advanced Search configuration. Fixes are in GitLab CE/EE 19.3.2, 19.2.6, and 19.1.
Why it matters: Organizations that host their own GitLab servers could expose sensitive internal files or credentials if they delay patching. This is urgent: admins should upgrade affected GitLab CE and EE systems immediately, even though GitLab.com and GitLab Dedicated are already patched.
2026.09.14
98% relevant
This article advances the same event by adding that CISA has now placed CVE-2026-85706 in the Known Exploited Vulnerabilities catalog and that watchTowr observed real-world probing of internet-facing GitLab servers days after the September 10 patch.
Sergiu Gatlan
2026.09.14
97% relevant
This updates the same underlying event by adding that CISA has now confirmed active exploitation of CVE-2026-85706 in the wild, added it to the KEV catalog, and imposed a three-day federal remediation deadline.
info@thehackernews.com (The Hacker News)
2026.09.11
96% relevant
This article appears to update the same GitLab file-read vulnerability by adding that internet-wide probing or attempted exploitation began after disclosure, increasing urgency for organizations running affected self-managed GitLab instances.
Ionut Arghire
2026.09.11
97% relevant
This source updates that same GitLab event with new confirmation that CVE-2026-85706 began seeing in-the-wild exploitation attempts one day after disclosure, and adds concrete hunting guidance for suspicious POST requests to /api/v4/projects/{id}/repository/commits/ with file.path parameters.
Sergiu Gatlan
2026.09.11
100% relevant
This article appears to be the first clear report in the tracked set about GitLab's September 2026 fixes for CVE-2026-85706 and CVE-2026-87719, establishing the event and the affected versions.
← Back to all stories