Cybersecurity experts are sounding the alarm over a newly disclosed vulnerability in GitLab, a popular platform used by developers to collaborate on software projects. The flaw, known as CVE-2026-85706, has already been exploited by threat actors, who are using it to gain access to sensitive information and potentially compromise entire supply chains.
The vulnerability, which affects both GitLab Community Edition and Enterprise Edition instances, is a path traversal issue that allows unauthenticated individuals to read arbitrary files from the GitLab server. This means that even without logging into the system, an attacker can browse through files on the server, including sensitive configuration files and credentials. The vulnerability has been rated as having a maximum severity rating of 10 out of 10 by the Common Vulnerability Scoring System (CVSS).
According to researchers at watchTowr, a cybersecurity vendor that monitors honeypot networks for malicious activity, threat actors have already begun exploiting CVE-2026-85706 in earnest. “Over the weekend, we observed threat actors dumping config files for secrets along with system SSH configurations for the victim system,” said Jake Knott, head of threat intelligence at watchTowr. This kind of access can be incredibly valuable to attackers, as it allows them to extract passwords and connect to instances that use password authentication.
What’s particularly worrying about this vulnerability is its potential impact on software supply chains. Even though CVE-2026-85706 only grants an attacker read-only access to a GitLab instance, they could still use that access to obtain sensitive information like credentials and CI/CD secrets. This could enable a full compromise of the GitLab instance and potentially grant the attacker further admission into an organization’s development environment and other critical downstream systems.
One reason why this vulnerability is so concerning is that it requires only one public project on the GitLab server to be targeted. While organizations can gate access to their system, they may not always realize that projects created as “public” are still accessible to outsiders. In some cases, companies might intentionally expose codebases publicly for collaboration purposes, but in others, they might mistakenly assume that a project is internal if it’s made public within the GitLab system.
Given the severity of this vulnerability, watchTowr has urged GitLab customers to update their self-hosted instances to versions 19.3.2, 19.2.6, or 19.1.8 for Community Edition and Enterprise Edition. If updating is not possible, organizations should immediately remove all public access to their instances. The online GitLab.com platform has already patched the flaw.
To mitigate the risk of exploitation, security teams are advised to review access logs on the repository commits API for any suspicious or unauthenticated requests that suggest probing or exploitation activity. This includes reviewing logs for unusual patterns of file access or requests that come from unknown IP addresses.
The exploitation of CVE-2026-85706 serves as a stark reminder of the importance of keeping software up to date and monitoring system activity closely. Organizations should take immediate action to patch their systems and review their access controls to prevent potential supply chain attacks.
Source: Dark Reading — 2026-09-14