CVE-2026-85706: critical GitLab flaw allows file theft without credentials

CVE-2026-85706: critical GitLab flaw allows file theft without credentials

In short

GitLab has confirmed a critical vulnerability (CVE-2026-85706, CVSS 10.0) that allows an attacker without credentials to read arbitrary files from the server [1]. It is included in CISA's KEV catalog of actively exploited vulnerabilities [2]. It affects GitLab Community and Enterprise Edition instances [1]. If your company uses GitLab, today's priority is to identify the installed version and apply the corresponding patch without delay.

What it is and why it matters

The vulnerability resides in GitLab's repository commits API. According to the official description, a path confinement flaw combined with a missing authentication check allows an unauthenticated user to access arbitrary files on the server through path traversal techniques [1]. NVD has rated it as critical severity with a CVSS score of 10.0, the maximum possible [1], reflecting that it can be exploited remotely, without privileges or user interaction, and with a potentially total impact on data confidentiality.

OCIRIA's intel team has classified this vulnerability as "Path traversal / file access" and highlights that, since it requires no authentication, any GitLab instance exposed to the internet is a direct target: source code, configuration files with secrets, environment variables, or credentials stored in the repository could be exposed without leaving a trace of authenticated access.

The fact that the vulnerability appears in the CISA KEV catalog is a relevant data point: it means there is evidence of active exploitation in the real world, not just a theoretical risk [2].

Who is affected

It affects organizations running self-managed instances of GitLab Community Edition (CE) or Enterprise Edition (EE) [1]. According to the vendor's official description, the range of affected versions spans from the 18.7 series to specific versions in the 19.0, 19.1, 19.2, and 19.3 series, each with its corresponding fixed version [1]. Given how broad the range is, any development, DevOps, or platform team maintaining GitLab on-premise or on their own infrastructure should consider themselves potentially exposed until they verify their specific version.

Organizations using GitLab.com (SaaS) directly managed by GitLab usually receive patches centrally, but it's worth confirming with the team responsible for that account if there is any doubt about the deployment model.

How to know if you're vulnerable

• Identify the exact version of GitLab CE/EE you have deployed (visible in the admin panel or at the /help endpoint).
• Compare that version with the affected ranges indicated by the vendor [1]: 18.7–18.11.12, 19.0–19.0.9, 19.1–19.1.8, 19.2–19.2.6, and 19.3–19.3.2.
• Check whether your GitLab instance is accessible from the internet without network restrictions (VPN, IP allowlisting), since exploitation does not require authentication.
• As part of your general security hygiene, it's worth mapping which of your organization's assets and services are exposed to the internet; OCIRIA's attack surface radar is designed precisely to detect this type of exposure on an ongoing basis.

How to protect yourself

1. Update GitLab immediately to the first fixed version in your branch (18.11.12, 19.0.9, 19.1.8, 19.2.6, or 19.3.2, as applicable) [1].

2. Restrict network access to the instance while completing the update: limit access to trusted IPs or corporate VPN.

3. Audit access logs to the commits API during the period your instance was on a vulnerable version, looking for path traversal patterns or anomalous unauthenticated access.

4. Rotate credentials and secrets that might be stored in accessible repositories or configuration files, as a precaution against possible exposure.

5. Prioritize this patch over other pending ones: the combination of CVSS 10.0 and presence in CISA KEV indicates maximum risk and known exploitation [1][2].

FAQ

Do I need to be authenticated to be attacked? No. The vulnerability allows access to an attacker without credentials, which makes it especially dangerous [1].

Is there evidence of active exploitation? Yes, the vulnerability is included in the CISA KEV catalog, which lists vulnerabilities with confirmed active exploitation [2].

Does it also affect GitLab.com? The official description refers to GitLab CE/EE instances; if you use GitLab.com as a managed service, confirm the patch status with your provider.

Is it enough to update, or should I do something else? Updating is the essential step, but given the risk of file exposure during the vulnerable period, reviewing logs and rotating sensitive credentials is a reasonable precaution.

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-85706
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json