Critical GitLab flaw lets one request read any file from self-hosted servers

CISA warned that attackers are exploiting a critical flaw in self-managed GitLab servers, adding it to its exploited-vulnerabilities catalog with a forensic-triage requirement. Tracked as CVE-2026-85706 and scored 10.0, it is a path-traversal bug in GitLab's repository commits API caused by improper path confinement and missing authentication, letting an unauthenticated attacker read any file on the server with a single crafted request. Exposed files can include SSH keys, database credentials, deploy tokens, CI/CD variables, and source code. GitLab patched it on September 10, and researchers observed in-the-wild probing within about a day. GitLab.com is unaffected; the risk is concentrated on the many self-managed instances organizations run.

Check

Upgrade self-managed GitLab to 19.1.8, 19.2.6, 19.3.2, or later immediately, then rotate secrets the server could expose, including access tokens, deploy tokens, CI/CD variables, SSH keys, and cloud credentials.

Affected

Organizations running self-managed GitLab CE or EE from 18.7 up to the patched releases (CVE-2026-85706); an unauthenticated attacker can read arbitrary files, including secrets and source, in one request.

Fix

Patch now, rotate all potentially exposed secrets, review commits-API and web-server logs for unauthenticated requests with traversal patterns and unusual file access, and treat exposed unpatched instances as possibly already breached.