A maximum-severity vulnerability in GitLab’s software development platform is putting supply chains at risk, as threat actors are exploiting a path traversal flaw to read arbitrary files from affected servers. The vulnerability, known as CVE-2026-85706, was disclosed by GitLab on September 10 and has since been added to the US government’s list of Known Exploited Vulnerabilities.
GitLab Community Edition and Enterprise Edition instances are both vulnerable to this flaw, which allows unauthenticated individuals to access sensitive files. The vulnerability stems from improper path confinement and missing authentication checks in the platform’s repository commits API. GitLab patched the issue with updates 19.3.2, 19.2.6, or 19.1.8 for Community Edition and Enterprise Edition, but some organizations may still be at risk.
Researchers with cybersecurity vendor watchTowr observed behavioral probes for the flaw on their honeypot network as early as September 14. By Friday, malicious activity had escalated to full exploitation and the exfiltration of sensitive files. Jake Knott, head of threat intelligence at watchTowr, warns that this vulnerability is particularly concerning because it can be used to obtain sensitive information like credentials and CI/CD secrets.
While CVE-2026-85706 only grants an attacker read-only access to a GitLab instance, this access could be used to gain further admission into an organization’s development environment and other critical downstream systems. Knott describes the flaw as a supply chain attack-enabling vulnerability because it allows attackers to gain access to sensitive information that can be used to compromise other parts of the software development process.
The good news is that exploitation of CVE-2026-85706 requires at least one public project on the GitLab server, which may not be common in all organizations. However, Knott notes that some companies might not be aware that they have public projects on the platform or may assume that their internal projects are still private.
To mitigate this vulnerability, watchTowr urges GitLab customers to update their self-hosted instances immediately if possible. If updating is not feasible, all public access should be removed from the instance. Additionally, security teams should review access logs on the repository commits API for any suspicious or unauthenticated requests that may suggest probing or exploitation activity.
In conclusion, this vulnerability serves as a reminder of the importance of regular software updates and monitoring for potential security risks. Organizations running GitLab should take immediate action to patch their instances and review their configuration to ensure they are not inadvertently exposing sensitive information to attackers. By being proactive about security, organizations can reduce the risk of supply chain attacks and protect their critical systems from exploitation.
Source: Dark Reading — 2026-09-14