GitLab’s Critical Flaw Already Under Attack, Patches Urged for Immediate Upgrade
A high-severity vulnerability in GitLab’s software development platform has left it wide open to potential attacks, with a security firm already detecting probes against the flaw. The company has released emergency patches for two critical flaws, one of which holds the highest possible severity score, and is urging users to upgrade their self-managed installations as soon as possible.
The more serious of the two vulnerabilities, CVE-2026-85706, affects every release from 18.7 up to 19.1.8, as well as the 19.2 and 19.3 lines before this week’s patches. According to GitLab, under certain conditions an attacker could read any file on the server without needing an account or credentials. This is because the code failed to confine file paths properly and did not enforce authentication.
The flaw has been assigned a CVSS score of 10.0, the highest possible rating in the industry. In simple terms, this means that if exploited, it could have catastrophic consequences for affected organizations. The vulnerability sits in the interface that handles repository commits, making it a prime target for attackers looking to exploit it.
The second flaw, CVE-2026-87719, affects only GitLab’s Enterprise Edition and has been assigned a CVSS score of 9.9. This vulnerability allows a logged-in user with Duo Chat access to hide a command inside an ordinary request, prompting the server to look up its own settings for the Advanced Search feature, which would return the settings and passwords being held.
WatchTowr Labs, a security firm, has already detected probes against the path traversal flaw, which can be triggered in just one HTTP request. The firm warns that organizations running self-hosted GitLab servers reachable from the open internet face the greatest risk and should immediately review their logs for suspicious activity. They recommend looking for POST requests to addresses under /api/v4/projects/{id}/repository/commits/ that carry a file.path parameter.
The Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerabilities to its Known Exploited Vulnerabilities list, indicating that these flaws are now considered a high priority by the government. Given the severity of this vulnerability and the history of similar GitLab flaws being exploited shortly after patches were released, it’s essential for users to act quickly.
To protect yourself from potential attacks, we urge all affected users to immediately upgrade their self-managed installations to the latest patched versions. This will not only prevent exploitation but also ensure that your organization stays up-to-date with the latest security patches and features. Remember, timely patching is a critical aspect of maintaining the security of your software development platform, and it’s essential to stay vigilant in today’s threat landscape.
Source: CyberScoop — 2026-09-11