Hackers Exploit Maximum Severity Flaw in GitLab

GitLab users are being urged to patch a maximum severity vulnerability in the platform after reports of “in-the-wild” exploitation.

CVE-2026-85706 is described as an “improper limitation of a pathname to a restricted directory,” or “path traversal” flaw.

The DevSecOps orchestration platform fixed the issue on September 10.

“GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API,” a security advisory noted.

Read more on GitLab threats: Proxyjacking and Cryptomining Campaign Targets GitLab.

Although GitLab itself hasn’t flagged the vulnerability as being exploited, others have.

Cybersecurity vendor watchtower said on September 11 that it had already detected “in-the-wild probes” for the critical bug.

“Based on recent GitLab vulnerabilities, we know the time until indiscriminate exploitation is likely not far away,” it added.

“Organizations with public-facing self-hosted GitLab instances should patch as soon as possible or remove public access.”

The vendor urged customers to identify potential exploitation attempts by hunting through log files for HTTP POST requests to "/api/v4/projects/{id}/repository/commits/" URIs containing "file.path" parameters.

Another Entry on the CISA Kev Catalog

On the same day, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) Catalog.

“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” it said.

Only civilian federal agencies are mandated to fix KEV vulnerabilities, in this case with a deadline of September 15. However, it’s also considered best practice for private sector organizations.

“Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable,” CISA recommended.

Security experts have warned that AI tools are helping would-be hackers weaponize new vulnerabilities much quicker than before, while also enabling them to find novel flaws more easily.

Back in May, Google Threat Intelligence Group (GTIG) claimed a first when it revealed how threat actors had been using AI to identify and exploit a zero-day vulnerability.

Image credit: Samuel Boivin / Shutterstock.com