GitLab fixes CVSS 10 vulnerability already targeted by hostile scans

GitLab has released updates for several vulnerabilities in Community Edition and Enterprise Edition, including two critical flaws and six high-severity issues. The most urgent is CVE-2026-85706, a path traversal vulnerability with a CVSS score of 10 in the repository commits API. An unauthenticated user could exploit it to read arbitrary files from the GitLab server, potentially retrieving configurations, credentials, or other sensitive data. Probes linked to exploitation attempts were observed just hours after the public disclosure, drastically reducing the time available to respond. Organizations operating exposed GitLab instances should update immediately, review logs for anomalous API requests, and consider any secrets accessible by the service to be compromised.

Source: The Hacker News