Critical Flaws in GitLab Platform Expose Users to Remote Attacks, Patches Released Amid Growing Probes
GitLab’s software development platform has been hit with two high-severity flaws, one of which holds the highest possible severity score. The company has rushed out emergency patches for both issues, but a security firm has already spotted attackers probing the internet for vulnerabilities in the wild.
The most critical flaw, tracked as CVE-2026-85706, resides in the interface that handles repository commits. In a worst-case scenario, an attacker could read any file on the server without needing an account or credentials. GitLab’s own assessment gives this vulnerability a CVSS score of 10.0, the top of the scale used across the industry. The flaw affects every release from 18.7 up to 19.1.8, as well as the 19.2 and 19.3 lines before this week’s patches.
The second flaw, CVE-2026-87719, is specific to GitLab’s Enterprise Edition. A logged-in user with Duo Chat access could hide a command inside an ordinary request, prompting the server to reveal sensitive information like passwords. This vulnerability also carries a CVSS score of 9.9 and affects releases from 18.3 onward.
According to WatchTowr Labs, which has been monitoring the situation, organizations running self-hosted GitLab servers exposed to the open internet are at greatest risk. The security firm recommends that defenders review their logs for POST requests to addresses under /api/v4/projects/{id}/repository/commits/ that carry a file.path parameter.
The timing of these vulnerabilities is particularly concerning. Given the history of similar flaws in GitLab, it’s likely only a matter of time before we see broad, untargeted attacks exploiting these weaknesses. As one security expert noted, “Based on recent GitLab vulnerabilities, we know the time until indiscriminate exploitation is likely not far away.”
As a result, users are urged to upgrade their installations as soon as possible, particularly those running self-hosted servers. The Cybersecurity and Infrastructure Security Agency (CISA) has added these vulnerabilities to its Known Exploited Vulnerabilities list, further emphasizing the need for prompt action.
In practical terms, this means that all users of GitLab’s Community Edition and Enterprise Edition should review their patch levels and upgrade to the latest versions immediately. If you’re running a self-hosted installation, it’s essential to check your logs regularly for suspicious activity and take steps to minimize your exposure.
Source: CyberScoop — 2026-09-11