CVE-2026-85706
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Sep 11, 2026
- US federal agencies must remediate it by Sep 14, 2026 (BOD 22-01)
- Attacked 1 day before the vulnerability was made public
- Confirmed by sensors, not only by reports
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Oct 27, 2026 Oct 26, 2026 Oct 25, 2026 Oct 23, 2026 Oct 22, 2026 Oct 20, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NAffected products
| Vendors | Product | Versions |
|---|---|---|
| gitlab | gitlab | < 18.11.12 |
Related articles
GitLab Fixes CVSS 10.0 CI/CD Flaw Enabling Unauthenticated Server Code Execution
GitLab patched CVE-2026-97229, a CVSS 10.0 CI/CD flaw that could allow unauthenticated code execution via crafted regex, plus three high-severity fixes.
FBI Seizes Seven Domains Supporting Flax Typhoon Scanning and Malware Operations
FBI seized domains allegedly supporting MicroScan and FishHub scanning and malware platforms attributed to China-linked Flax Typhoon operators.
GitLab Fixes AI Gateway Sandbox Escape Enabling Command Execution
GitLab fixed a critical AI Gateway sandbox escape that could let authenticated users execute commands. Self-hosted gateways should upgrade to patched releases.
Active Attacks Put Zyxel Switches and Veeam-Protected Windows Endpoints at Risk
CISA warns of active exploitation of Zyxel GS1900 flaw CVE-2026-7273 and Veeam Agent Windows privilege escalation CVE-2026-32996. Patch now.
Cisco ISE API Authentication Flaw Opens a Remote Path to Root Access
Cisco warns of exploited CVE-2026-76460 in ISE with CVSS 10.0 enabling unauthenticated remote root access. See affected versions, patches, mitigations.
Critical ScreenConnect Flaw Fuels Worm-Like Attacks Through Active Remote Sessions
CVE-2026-84869 lets attackers execute files via active ScreenConnect sessions in worm-like attacks. Patch clients to 26.6.5.9742 now.
GitLab Path Traversal Flaw Enters CISA KEV With Three-Day Patch Deadline
GitLab CVE-2026-85706 allows unauthenticated file access via API. CISA added it to KEV with Sept 14 deadline. Learn affected versions and fixes.
Critical GitLab File-Read Flaw Exploited Within a Day of Patch Disclosure
Unauthenticated GitLab flaw CVE-2026-85706 (CVSS 10) exploited within a day. Learn affected versions, detection logs and patch deadline.
This product uses the NVD API but is not endorsed or certified by the NVD.