GitLab’s Urgent Warning: Patch Now Against Maximum-Security Flaw
GitLab has issued an urgent warning to its users, advising them to patch their servers immediately against a maximum-severity path traversal vulnerability. The security flaw, dubbed CVE-2026-85706, allows unauthenticated attackers to read arbitrary data from vulnerable servers, including sensitive information like credentials and secrets.
The bug was discovered by a security researcher using the ‘s3ntago’ handle through GitLab’s HackerOne bug bounty program. It stems from improper path confinement and missing authentication enforcement in the repository commits API. Unpatched servers can be exploited under certain conditions to expose sensitive data, making it essential for users to patch their systems as soon as possible.
While GitLab has not yet reported any instances of the flaw being exploited in the wild, a cybersecurity company called watchTowr has already detected attempts by attackers to probe Internet-exposed GitLab servers unpatched against CVE-2026-85706. This warning is particularly concerning given that GitLab’s DevSecOps platform is used by over 30 million registered users and over 50% of Fortune 100 companies, including major brands like Nvidia and Airbus.
The vulnerability is not the only security issue affecting GitLab recently. Just a day prior to the announcement about CVE-2026-85706, the company patched another critical flaw (CVE-2026-87719) that stems from an insecure deserialization weakness in the GraphQL subscription serializer. This bug affects authenticated users with Duo Chat access and allows them to steal sensitive credentials and Advanced Search instance configurations.
The repeated warnings from GitLab highlight the importance of keeping software up-to-date, especially for critical systems like DevSecOps platforms. The company has emphasized that all self-managed installations should be upgraded to the latest patched versions (19.3.2, 19.2.6, or 19.1) immediately.
The discovery of CVE-2026-85706 also underscores the ongoing issue with path traversal vulnerabilities in software products. As CISA and the FBI pointed out last year, these flaws have been a significant concern since at least 2007. Given the high severity of this flaw and its potential impact on sensitive data, it is essential for users to take immediate action to patch their systems.
In practical terms, GitLab users should prioritize upgrading to the latest patched versions and ensure that their servers are properly configured with authentication enforcement in place. This will help prevent unauthenticated attackers from exploiting CVE-2026-85706 and accessing sensitive information. As cybersecurity threats continue to evolve, it is crucial for software companies and their users to stay vigilant and take proactive steps to protect against vulnerabilities like this one.
Source: Bleeping Computer — 2026-09-11