CVE-2026-85706: 
GitLab 脆弱性の分析と軽減

CVE-2026-85706 is a critical path traversal and authentication bypass vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows unauthenticated attackers to read arbitrary files from the GitLab server via the repository commits API. It affects all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. GitLab disclosed and patched the issue on September 12, 2026. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, CISA KEV).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and stems from two compounding flaws in GitLab's repository commits API: improper path confinement and missing authentication enforcement (GitHub Advisory). The root cause lies in the request handling pipeline between GitLab Workhorse and the Rails application — Workhorse's regex-based authentication checks can be bypassed by appending a .json suffix or a trailing slash to the API endpoint URL, or by percent-encoding path segment characters (e.g., %63ommits for commits). Once the request bypasses Workhorse, Puma decodes the path and Rails processes the file.path parameter — reading and evaluating the specified file — before the authentication check is reached. File contents are leaked through HTTP error responses: when the file contains invalid %-encoding sequences, Rack's error message echoes the file content back to the attacker. Multiple public PoC repositories demonstrate this technique (FlowerWitch PoC, guneykabel PoC).

Successful exploitation allows an unauthenticated remote attacker to read any file accessible to the GitLab process user (typically git), including highly sensitive files such as /etc/passwd, /opt/gitlab/embedded/service/gitlab-rails/config/gitlab.yml, /etc/gitlab/gitlab-secrets.json, database credentials, SSH private keys, API tokens, and CI/CD secrets (GitHub Advisory). The confidentiality and integrity impacts are rated High with a Changed scope, reflecting that leaked credentials can enable lateral movement to downstream systems, database tiers, and connected infrastructure. GitLab instances are frequently used as the backbone of software supply chains, meaning compromise can cascade to source code repositories, CI/CD pipelines, and production environments (CISA KEV).

CVE-2026-85706 is being actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026, with a remediation due date of September 14, 2026 (CISA KEV). Exploitation was observed within 24 hours of patch release, with internet-wide scanning and active file-read attacks reported by multiple threat intelligence sources (Security Affairs, Rapid7). At least five high-confidence public PoC exploit tools are available on GitHub, including bash-based Docker exploit environments and fully automated Python scripts with interactive shells and auto-loot capabilities (FlowerWitch PoC, GitLabSniper). A Metasploit module pull request was also submitted. The EPSS score is approximately 14.56% (96th percentile), indicating a very high probability of exploitation (GitHub Advisory). No specific threat actor attribution has been publicly confirmed.

1. Reconnaissance: Identify internet-facing GitLab CE/EE instances running affected versions (18.7–19.1.7, 19.2.0–19.2.5, or 19.3.0–19.3.1) using tools like Shodan, Censys, or by querying /api/v4/version. Enumerate publicly accessible project IDs via GET /api/v4/projects?simple=true&per_page=50 (unauthenticated for public projects) or default to project IDs 1–7.

2. Select bypass technique: Choose one of two primary bypass methods:

   • .json suffix bypass: Append .json to the commits API endpoint to evade Workhorse authentication regex.
   • Trailing slash bypass: Append a trailing / to the endpoint URL, which similarly bypasses Workhorse rewrite rules.
   • Percent-encoding bypass: Use URL-encoded path segments (e.g., /api/v4/projects/1/repository/%63ommits) to evade signature-based filters.

3. Craft malicious request: Construct an HTTP POST request to the target endpoint (e.g., http://target/api/v4/projects/1/repository/commits/) with a Content-Type: application/x-www-form-urlencoded body containing file=&file.path=/etc/passwd&file.size=1. No authentication headers are required.

4. Trigger pre-authentication file read: The Rails application processes the file.path parameter and reads the specified file before the authentication check is reached. If the file content contains characters that produce invalid %-encoding sequences, Rack's error handler echoes the content in the HTTP 400 response body as invalid %-encoding (...) (guneykabel PoC).

5. Extract leaked content: Parse the HTTP response body using a regex such as invalid %-encoding \((.*)\) to extract the echoed file content. For files that do not trigger the encoding error, classify the response (e.g., local file not present confirms file existence oracle; HTTP 401 confirms pre-auth read occurred).

6. Escalate via leaked credentials: Target high-value files such as /etc/gitlab/gitlab-secrets.json, /opt/gitlab/embedded/service/gitlab-rails/config/gitlab.yml, /var/opt/gitlab/gitlab-rails/etc/database.yml, /root/.ssh/id_rsa, and /proc/self/environ to extract database credentials, API tokens, SSH keys, and encryption keys for follow-on lateral movement or privilege escalation (GitLabSniper).

• Network: Unusual HTTP POST requests to /api/v4/projects/{id}/repository/commits, /api/v4/projects/{id}/repository/commits/ (trailing slash), or /api/v4/projects/{id}/repository/commits.json from unauthenticated sources; POST requests to percent-encoded variants such as /api/v4/projects/{id}/repository/%63ommits; outbound connections from the GitLab server to unknown external IPs following API access.
• Logs: GitLab access logs showing POST requests to repository commits API endpoints with file.path parameters pointing to system files (e.g., /etc/passwd, /etc/gitlab/gitlab-secrets.json, /proc/self/environ); HTTP 400 responses containing invalid %-encoding in the response body; repeated unauthenticated API requests from a single IP or user-agent string such as cve-2026-85706-poc/2.0 or Mozilla/5.0 spoofed strings.
• File System: No direct file system artifacts from the exploit itself (it is a read-only attack); however, subsequent attacker activity using leaked credentials may create new SSH authorized keys, modified GitLab configuration, or new admin accounts.
• Process: Unusual child processes spawned by the GitLab Rails or Workhorse process; unexpected outbound network connections from the git user account.
• Threat Intelligence: Nuclei template CVE-2026-85706 detections; Velociraptor artifact Linux.Detection.CVE202685706.GitLabFileRead hits (GitHub Advisory, CISA KEV).

GitLab has released patched versions: 19.1.8, 19.2.6, and 19.3.2. All self-managed GitLab CE/EE instances running affected versions (18.7 through 19.3.1) should be upgraded immediately (GitLab Patch Release). GitLab.com (SaaS) is not affected. As a temporary workaround where immediate patching is not possible, restrict network access to the GitLab API endpoint (particularly the /api/v4/projects/*/repository/commits path) at the firewall or WAF level, and monitor API logs for suspicious unauthenticated POST requests. CISA's BOD 26-04 required federal agencies to remediate by September 14, 2026 (CISA KEV). Given active exploitation and the sensitivity of files accessible to the GitLab process, organizations should also rotate all secrets stored on the GitLab server (database credentials, API tokens, SSH keys, gitlab-secrets.json contents) as a precautionary measure.

The vulnerability generated significant attention across the security community immediately after disclosure. Rapid7 published an emergency threat report confirming in-the-wild exploitation and internet-wide scanning within 24 hours of the patch (Rapid7). watchTowr, Horizon3.ai, Beazley Security Labs, and SOCRadar all published rapid-reaction analyses noting the severity and ease of exploitation (Beazley Labs, SOCRadar). Security Affairs described it as "one HTTP request, no authentication, full file read" and noted exploitation within 24 hours (Security Affairs). Dark Reading highlighted the supply chain risk given GitLab's role in CI/CD pipelines. The Hacker News, BleepingComputer, The Register, CyberScoop, and Infosecurity Magazine all covered the story prominently. Community sentiment on Reddit and Mastodon was alarmed, with many practitioners noting the unusually short window between patch release and active exploitation. Censys reported observing internet-wide scanning activity targeting the vulnerable endpoint.