GREENBONEOS: CVE-2026-85706: CVSS 10 GITLAB CE/EE API FLAW ACTIVELY EXPLOITED

# GitLab's Worst Nightmare: CVE-2026-85706 Path Traversal Flaw Hits CVSS 10 – Active Exploitation Confirmed

**Intro:** A critical zero-day-style vulnerability in GitLab Community Edition and Enterprise Edition has sent shockwaves through the DevOps world. CVE-2026-85706, a path traversal flaw scoring a perfect 10 on the CVSS scale, is now under active exploitation, with CISA adding it to the Known Exploited Vulnerabilities catalog and security researchers already publishing proof-of-concept code. If you're running self-managed GitLab instances, this is the wake-up call you can't afford to ignore.

**The Vulnerability That Breaks the Build Pipeline**

When cybersecurity researchers at watchTowr started seeing probes against their honeypot network in early September 2026, they knew something significant was brewing in the hacking underground. Days later, on September 12th, 2026, the cybersecurity community learned the full scope of the threat. CVE-2026-85706 represents a critical path traversal vulnerability [CWE-22] combined with missing authentication enforcement [CWE-306] in GitLab's repository Commits API and Repository Files API. This isn't just another theoretical vulnerability lurking in the shadows – this is a weaponized exploit actively being used in the wild.

The severity of this vulnerability cannot be overstated. With a CVSS score of 10.0 and an EPSS percentile ranking in the 96th, this is among the most dangerous classifications a software vulnerability can receive. The flaw allows an unauthenticated attacker to read arbitrary files from the GitLab server on affected self-managed instances. For organizations running GitLab as their DevOps backbone, this represents a catastrophic security failure that could expose source code, credentials, and CI/CD pipeline secrets. The timing is particularly brutal – CISA added this CVE to its Known Exploited Vulnerabilities catalog on September 11th, even before the official public disclosure.

**Deep Dive: How the Exploitation Works**

What makes CVE-2026-85706 particularly nasty from a vulnerability research perspective is the attack surface it exposes. The exploitation path leverages both the repository Commits API and the Repository Files API, with independent security analyses demonstrating the same vulnerable behavior through POST and PUT operations. While the arbitrary file read primitive doesn't directly enable remote code execution (RCE), it executes with the permissions of the GitLab service context – typically the "git" user – granting attackers significant access to sensitive system files.

There is one caveat that provides slight comfort: the unauthenticated exploit path requires at least one anonymously readable project with repository access enabled. However, in most GitLab instances, this condition is easily met, as many organizations maintain public repositories for open-source projects, documentation, or shared resources. Attackers are actively scanning for these configurations, as evidenced by the watchTowr honeypot data and the rapid appearance of multiple technical analyses and PoC exploit code [1][2][3][4][5].

**The Cyber Kill Chain: From File Read to Full Compromise**

The danger of CVE-2026-85706 extends far beyond simple information disclosure. When we think about a typical GitLab deployment, we're talking about a system that holds the crown jewels of software development: source code repositories, SSH private keys, certificate files in .pem format, environment configuration files, SMTP credentials, LDAP authentication data, and database connection strings. The exploitation of this vulnerability could expose critical files such as gitlab.yml, secrets.yml, gitlab-secrets.json, and database.yml.

Worse yet, if attackers manage to disclose the instance secret key base, they may be able to forge sessions and tokens, decrypt stored CI/CD variables, and even bypass multi-factor authentication (MFA) responses. This transforms a file-read vulnerability into a potential full-scale infrastructure compromise. The implications for supply-chain security are enormous – a breach of this nature could allow attackers to inject malware into software builds, compromise downstream clients, and pivot laterally within the victim's network. This isn't just a GitLab problem; it's a systemic risk to the entire software development ecosystem.

**Patch Management Emergency: Your Action Plan**

GitLab has responded with a coordinated security release that patches CVE-2026-85706 alongside 17 other vulnerabilities, one of which also carries critical severity ratings. The patched versions for self-managed installations are 19.1.8, 19.2.6, and 19.3.2. If you're running versions from 18.7 onward but below these patches, you're in the danger zone. Organizations on 18.x or 19.0.x releases face an even grimmer situation – there is no patch available for these versions, meaning you must upgrade to at least 19.1.8 to secure your infrastructure.

GitLab has confirmed that its managed infrastructure, including GitLab.com and GitLab Dedicated, has already been patched. However, for the thousands of organizations running self-managed instances, the responsibility falls squarely on their security teams. Unfortunately, GitLab has not provided any workaround mitigations for this vulnerability, making immediate patching the only reliable defense. In the interim, security teams should consider removing GitLab from public internet exposure, implementing strict IP-based access controls, and deploying web-application firewall (WAF) rules specifically targeting the Commits API and Repository Files API endpoints.

**Detection and Defense: Greenbone's OpenVAS to the Rescue**

In the ongoing battle against cyber threats, vulnerability management tools are crucial for identifying exposed systems before attackers strike. Greenbone's OPENVAS ENTERPRISE FEED has already added a remote banner check for CVE-2026-85706, allowing defenders to quickly identify vulnerable GitLab instances across their infrastructure. This detection capability arrived soon after the disclosure, demonstrating the critical importance of real-time vulnerability intelligence feeds.

The OPENVAS ENTERPRISE FEED also provides regular detection for GitLab vulnerabilities more broadly, making it an essential tool for organizations running this popular DevOps platform. For security teams looking to assess their exposure, Greenbone offers a free two-week trial of the OPENVAS ENTERPRISE FEED through their OPENVAS SCAN product. This kind of proactive security assessment is exactly what organizations need in an era where vulnerabilities are weaponized almost as quickly as they're disclosed.

**Final Thoughts on Securing Your DevOps Pipeline**

CVE-2026-85706 represents one of the most serious GitLab vulnerabilities we've seen, combining maximum CVSS severity with active exploitation and readily available PoC code. The cybersecurity community has rallied with numerous national CERT alerts [6][7][8][9][10][11][12][13][14][15][16][17][18], and threat intelligence feeds are tracking this vulnerability around the clock. For defenders, this is a race against time. Every day that passes with an unpatched GitLab instance is a day that sophisticated attackers could be reading your source code, stealing your secrets, and compromising your software supply chain.

The path forward is clear: check your GitLab version immediately, accelerate your upgrade process, and ensure your vulnerability management program can detect these threats before they become breaches. Remember, in the world of cybersecurity, it's not a matter of if but when attackers find their way in. Make sure your defenses are ready for whatever comes next.