CVE-2026-85706: 
GitLab vulnerability analysis and mitigation

CVE-2026-85706 is a critical path traversal and authentication bypass vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows unauthenticated attackers to read arbitrary files from the GitLab server via the repository commits API. It affects all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The vulnerability was disclosed and published on September 12, 2026, with exploitation observed within 24 hours of disclosure. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, CISA KEV).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and stems from two compounding flaws: improper path confinement and missing authentication enforcement in the repository commits API (GitHub Advisory). The root cause lies in a request-handling discrepancy between GitLab's Workhorse reverse proxy and the Rails application backend. Workhorse applies regex-based path confinement checks, but these can be bypassed by URL-encoding path segments (e.g., %63ommits for commits, %72epository for repository, %66iles for files) or by appending a trailing slash or .json suffix to the endpoint URL. When Puma (the Ruby web server) decodes the path, the Rails handler receives the decoded request and processes the attacker-controlled file.path parameter — reading the specified file from the server filesystem — before authentication is enforced. File contents are leaked back to the attacker via Rack error messages (e.g., Invalid parameter: invalid %-encoding (...)) when the file contains characters that trigger a parsing error, or via direct response body inclusion depending on the bypass variant used (Feedly).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files accessible to the GitLab process user (typically git), resulting in complete confidentiality compromise of the server filesystem. High-value targets include GitLab configuration files (/opt/gitlab/embedded/service/gitlab-rails/config/gitlab.yml, /etc/gitlab/gitlab-secrets.json, database.yml), SSH private keys (/root/.ssh/id_rsa), environment variables (/proc/self/environ), and API tokens — all of which can enable lateral movement, database compromise, or full administrative takeover of the GitLab instance and downstream CI/CD infrastructure (GitHub Advisory, CISA KEV). The CVSS scope is marked as Changed, reflecting that leaked credentials can impact systems beyond the GitLab instance itself, including source code repositories, deployment pipelines, and connected services.

This vulnerability is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026, with a remediation due date of September 14, 2026 (CISA KEV). Exploitation was observed within 24 hours of public disclosure, with internet-wide scanning probes detected shortly after the patch was released (Rapid7). Multiple high-confidence public PoC exploits are available on GitHub (bash and Python), and a fully functional Metasploit auxiliary module (gitlab_file_read_cve_2026_85706.rb) has been merged into the Metasploit Framework (Metasploit). The EPSS score is approximately 14.6% (per Feedly data) though the GitHub Advisory Database reports a 91.4th percentile exploitation probability. No specific threat actor attribution has been publicly confirmed, but the vulnerability is noted as potentially relevant to ransomware campaigns per CISA's KEV entry.

1. Reconnaissance: Identify internet-facing GitLab CE/EE self-managed instances running vulnerable versions (18.7–18.11.11, 19.0.0–19.0.8, 19.1.0–19.1.7, 19.2.0–19.2.5, or 19.3.0–19.3.1) using tools like Shodan, Censys, or nuclei templates. Enumerate publicly accessible project IDs via GET /api/v4/projects?simple=true&per_page=50 (no authentication required for public projects), or default to project ID 1.

2. Construct bypass URL: Build a POST request URL using one of the known Workhorse bypass techniques:

   • Trailing slash: http://<target>/api/v4/projects/1/repository/commits/
   • .json suffix: http://<target>/api/v4/projects/1/repository/commits.json
   • URL-encoded path segment: http://<target>/api/v4/projects/1/repository/%63ommits

3. Inject target file path: Craft the POST body with the file.path parameter pointing to the desired server file:

   curl -X POST 'http://<target>/api/v4/projects/1/repository/commits/' \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     --data 'file=&file.path=/etc/gitlab/gitlab-secrets.json&file.size=1'

4. Send unauthenticated request: Transmit the request without any authentication headers (PRIVATE-TOKEN, Authorization). The Workhorse regex check is bypassed by the URL encoding or suffix; Puma decodes the path and forwards to Rails, which reads the file before enforcing authentication.

5. Extract file contents from response: Parse the HTTP response for the Invalid parameter: invalid %-encoding (...) error message, which echoes file content fragments. For JSON-formatted files, a JSONDecodeError response confirms the file was read. A local file not present message confirms the file does not exist (existence oracle).

6. Escalate via leaked credentials: Use extracted secrets (database credentials from gitlab.yml, session tokens from gitlab-secrets.json, SSH private keys) to authenticate to the GitLab instance as an administrator, access the database, or pivot to connected infrastructure (Feedly, Rapid7).

• Network: Unusual POST requests to /api/v4/projects/{id}/repository/commits/, /api/v4/projects/{id}/repository/commits.json, or URL-encoded variants (e.g., /%63ommits, /%72epository/commits) from unauthenticated sources; outbound connections from the GitLab server to unknown external IPs following such requests.
• Logs: GitLab/Nginx access logs showing POST requests to repository commits or files API endpoints without authentication tokens (PRIVATE-TOKEN header absent), especially with file.path parameters containing absolute paths (e.g., /etc/, /opt/gitlab/, /root/, /proc/); HTTP 400 responses containing Invalid parameter: invalid %-encoding in the response body.
• File System: Unexpected access timestamps on sensitive files such as /etc/gitlab/gitlab-secrets.json, /opt/gitlab/embedded/service/gitlab-rails/config/gitlab.yml, /opt/gitlab/embedded/service/gitlab-rails/config/database.yml, /root/.ssh/id_rsa, or /proc/self/environ.
• Process/Application: Rack/Puma error log entries referencing invalid %-encoding or Invalid parameter type errors triggered by API requests; anomalous GitLab admin account logins or API token usage following exploitation attempts.
• Threat Intelligence: User-agent strings associated with known PoC tools (e.g., cve-2026-85706-poc/2.0, Mozilla/5.0 with automated request patterns) in web server logs (Feedly, CISA KEV).

GitLab has released patched versions addressing CVE-2026-85706: 18.11.12, 19.0.9, 19.1.8, 19.2.6, and 19.3.2. All self-managed GitLab CE/EE administrators should upgrade immediately; GitLab.com (SaaS) is not affected (GitHub Advisory, CISA KEV). CISA's BOD 26-04 mandates federal agencies remediate by September 14, 2026, and requires forensic triage of potentially compromised systems. If immediate patching is not possible, restrict network access to the GitLab API (particularly the /api/v4/projects/*/repository/commits endpoint) at the network perimeter or WAF level, and monitor API logs for suspicious unauthenticated POST requests with file.path parameters. After patching, rotate all secrets stored on the GitLab server (database credentials, API tokens, SSH keys, gitlab-secrets.json contents) as a precautionary measure given the active exploitation.

The vulnerability generated significant industry attention due to its maximum CVSS score and rapid exploitation timeline. Security researchers and media widely reported exploitation within 24 hours of patch release, with watchTowr noting in-the-wild activity almost immediately after disclosure (Rapid7). Rapid7 published an emergency threat response (ETR) blog post, and Fortinet issued both a threat signal report and an outbreak alert for the vulnerability (FortiGuard). Security Affairs described it as "one HTTP request, no authentication, full file read" and noted it was exploited within 24 hours. Dark Reading highlighted the supply chain risk given GitLab's role in CI/CD pipelines. The community on Reddit, Hacker News, and Mastodon was highly active, with multiple researchers publishing technical deep-dives and PoC tools within hours of disclosure. CISA's rapid KEV listing (same day as disclosure) and the three-day remediation deadline underscored the severity of the threat.