Severe GitLab Flaw Exposes Sensitive Data: Immediate Action Required for Users

Another major security issue has emerged within GitLab's infrastructure, rated as a critical 10 in severity. The vulnerability, identified as CVE-2026-85706, allows attackers to execute arbitrary file reads via a single HTTP request. This path traversal flaw is attributed to inadequate confinement and insufficient authentication checks in GitLab’s repository commits API.

Threat actors could leverage this flaw “under certain conditions” to extract sensitive information such as credentials and other confidential data from affected GitLab servers. The company has issued a fix that applies to both GitLab Community Edition (CE) and Enterprise Edition (EE), strongly recommending that users with public-facing self-hosted GitLab instances either apply the patch immediately or restrict public access to their servers.

The gravity of this vulnerability is underscored by the fact that approximately 50% of the Fortune 100 rely on GitLab for their DevSecOps needs, with over 50 million registered users. “GitLab is not merely a code repository,” highlighted Safayat Moahamad, advisory director at Info-Tech Research Group. It integrates deeply with build pipelines, deployment workflows, and application security protocols.

Urgent Response Needed

Given GitLab's recent track record, urgency is critical. Earlier this year, the platform addressed a high-severity flaw that allowed attackers to bypass two-factor authentication with a target's account ID. In August, another major vulnerability was patched, which allowed unauthorized users to modify or even delete repositories effortlessly.

The newly disclosed maximum severity bug, CVE-2026-85706, was flagged through GitLab's HackerOne bug bounty program, affecting CE and EE versions up to specific patches in the 19.x series. The US Cybersecurity and Infrastructure Security Agency (CISA) has included it in its Known Exploited Vulnerabilities catalog, highlighting that such vulnerabilities are often favored targets for cybercriminals. Reports indicate ongoing “in-the-wild probes” aimed at exploiting this vulnerability, prompting urgent action.

This type of vulnerability isn't something organizations should address as part of their regular patch cycle, according to Moahamad. “It allows unauthenticated access to files on a system that is central to source code, build processes, and deployment workflows,” he added. Enterprises should prioritize patching, investigate any suspicious activity related to the repository-commits API, and assess exposed files for sensitive credentials that may need to be updated.

In addition to immediate patching, the watchTowr Intel team encourages organizations to proactively monitor logs for HTTP POST requests directed at the “/api/v4/projects/{id}/repository/commits/” URIs that include “file.path” parameters, as these could indicate exploitation attempts.

The Importance of CI/CD Security

Organizations operating affected versions of GitLab, especially those managing sensitive repositories, CI/CD pipelines, or production environments, need to particularly focus on this issue. The potential impact grows as attackers could obtain access to configuration files, sensitive server data, and credentials that could facilitate further breaches into connected systems.

The implications of unauthorized file access could lead to several severe outcomes, including credential theft, lateral movement through networks, exposure of source code, and even compromise of the supply chain itself. Moahamad emphasized that such critical infrastructure needs vigilant governance. While applying patches is vital, resilience comes from understanding the platforms’ vulnerabilities, restricting data access, identifying abnormal API activities, and implementing tested protocols for credential management.

David Shipley from Beauceron Security discussed the dual factors creating significant risks for GitLab users: the severity of the vulnerability and the prevalence of poor coding practices that lead to sensitive data being left in production. For attackers, this opens avenues for various malicious activities, from data theft to exploiting cloud infrastructures.

“This vulnerability is akin to having unguarded access to credit card information,” Shipley warned, stressing the urgency of removing sensitive secrets from code bases and adhering to best practices in authentication. The takeaway is clear: organizations must prioritize not just a fix but a strategic review of security protocols to fortify their DevSecOps practices against such vulnerabilities.