A Critical Vulnerability in GitLab Exposes Sensitive Data – What You Need to Know
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that hackers are now exploiting a maximum-severity vulnerability in GitLab’s DevSecOps platform. The security flaw, tracked as CVE-2026-85706, allows attackers to read sensitive information from vulnerable servers without authentication. This is not just any ordinary vulnerability – it’s one of the most severe types, and its exploitation could have devastating consequences for organizations that use GitLab.
To understand why this is such a big deal, you need to know that GitLab’s DevSecOps platform is used by over 50% of Fortune 100 companies and has over 30 million registered users worldwide. This means that thousands of businesses, including some of the world’s largest corporations, are at risk if they haven’t patched their systems yet. The vulnerability affects both GitLab Community Edition (CE) and Enterprise Edition (EE), making it a widespread issue.
So how does this exploit work? In short, attackers can use the vulnerability to read arbitrary files on a server using a single HTTP request. This is made possible by missing authentication enforcement and improper path confinement in the repository commits API. GitLab has already patched this issue in several versions of its software (19.3.2, 19.2.6, and 19.1), but users need to apply these patches immediately to avoid falling victim to attacks.
Cybersecurity firm watchTowr was one of the first to sound the alarm on this vulnerability, reporting that attackers were probing the Internet for GitLab servers unpatched against CVE-2026-85706 just a day after the patch was released. This suggests that hackers are already exploiting this flaw in real-world attacks.
CISA has added the vulnerability to its catalog of actively exploited flaws and is urging government agencies and all network defenders to take immediate action. While BOD 26-04 only targets federal agencies, CISA encourages private sector organizations to adopt a risk-based approach to vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.
This isn’t an isolated incident – since November 2021, CISA has tagged four GitLab vulnerabilities as actively exploited, including two in February this year. This highlights the importance of staying up-to-date with software patches and maintaining good cybersecurity hygiene.
So what can you do to protect yourself? First and foremost, make sure you’re running the latest version of GitLab (at least 19.3.2). If you haven’t patched your systems yet, do it now – this is not a drill. Additionally, keep an eye out for suspicious activity in your logs, particularly HTTP POST requests to ‘/api/v4/projects/{id}/repository/commits/’ URIs containing ‘file.path’ parameters.
By taking these simple steps, you can significantly reduce the risk of falling victim to attacks exploiting this critical vulnerability. Remember – cybersecurity is not just about patching vulnerabilities; it’s also about staying vigilant and proactive in the face of emerging threats.
Source: Bleeping Computer — 2026-09-14