GitLab: Critical CVE-2026-85706 Vulnerability Exploited Within 24 Hours

GitLab has disclosed CVE-2026-85706, a path traversal vulnerability with a CVSS score of 10.0 in the repository commits API. An unauthenticated attacker can send a single specially crafted HTTP request to read arbitrary files from the server. Potentially exposed data includes SSH keys, database credentials, deploy tokens, CI/CD variables, and sensitive configurations. watchTowr observed scanning and exploitation attempts online within 24 hours of the advisory's publication, while CISA added the flaw to its Known Exploited Vulnerabilities catalog. Organizations with Internet-exposed, self-hosted GitLab instances must update immediately, temporarily restrict public access, and search their logs for suspicious POST requests targeting the vulnerable API.

Source: Security Affairs