CVE-2026-85706: 
GitLab vulnerability analysis and mitigation

CVE-2026-85706 is a critical path traversal and authentication bypass vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The flaw allows unauthenticated remote attackers to read arbitrary files from the GitLab server by exploiting improper path confinement and missing authentication enforcement in the repository commits API. It was disclosed and patched on September 12, 2026, and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026, with a due date of September 14, 2026 (CISA KEV, GitHub Advisory). It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal) and stems from two compounding flaws in GitLab's request handling pipeline: improper path confinement in the repository commits API and missing authentication enforcement before file path resolution (GitHub Advisory). The attack exploits a mismatch between GitLab's Workhorse reverse proxy and the Puma/Rails application layer — Workhorse's regex-based authentication checks can be bypassed by appending a .json suffix or a trailing slash to the API endpoint URL (e.g., /api/v4/projects/{id}/repository/commits/ or /api/v4/projects/{id}/repository/commits.json), or by percent-encoding path segment characters (e.g., %63ommits for commits). Once the request bypasses Workhorse, Rails processes the file.path parameter and opens the specified file before the authentication check is reached. File contents are then leaked via Rack error messages (e.g., invalid %-encoding (...)) when the file path contains invalid percent-encoding sequences (Feedly). No authentication credentials or user interaction are required for exploitation.

Successful exploitation allows an unauthenticated attacker to read arbitrary files accessible to the GitLab process user (git) from the server filesystem, including highly sensitive files such as /etc/passwd, /etc/gitlab/gitlab-secrets.json, /opt/gitlab/embedded/service/gitlab-rails/config/secrets.yml, database.yml, SSH private keys (/root/.ssh/id_rsa), and environment variables (/proc/self/environ). Leaked credentials, API tokens, and encryption keys can enable follow-on attacks including database compromise, administrative account takeover, lateral movement to downstream services, and potentially remote code execution. The CVSS scope is rated as Changed, reflecting that the impact extends beyond the GitLab application itself to the broader infrastructure it supports (CISA KEV, GitHub Advisory).

This vulnerability is being actively exploited in the wild and was added to the CISA KEV catalog on September 11, 2026 — the same day as disclosure — with a mandatory remediation due date of September 14, 2026 (CISA KEV). At least five public proof-of-concept exploits were published on GitHub within hours of disclosure, including Docker-based PoC environments, Python exploit scripts, and a feature-rich interactive tool (GitLabSniper) capable of automated looting of sensitive files (Feedly). The vulnerability is fully automatable (no user interaction, no authentication, low complexity), and internet-wide scanning activity was observed within one day of the patch release. The EPSS score is reported as 0.0 at time of initial publication (likely to increase rapidly given active exploitation), and no specific threat actor attribution has been publicly confirmed. The vulnerability is flagged as requiring forensic triage per CISA BOD 26-04 (CISA KEV).

1. Reconnaissance: Identify internet-facing GitLab CE/EE instances running versions 18.7–19.1.7, 19.2.0–19.2.5, or 19.3.0–19.3.1 using tools like Shodan or Censys. Enumerate publicly accessible project IDs via GET /api/v4/projects?simple=true&per_page=50 (no authentication required for public projects); fall back to brute-forcing IDs 1–7 if listing fails.

2. Construct bypass request (Method 1 — trailing slash): Build a POST request to http://<target>/api/v4/projects/{project_id}/repository/commits/ (note the trailing slash, which bypasses Workhorse rewrite rules). Set Content-Type: application/x-www-form-urlencoded and include the body: file=&file.path=/etc/passwd&file.size=1.

3. Construct bypass request (Method 2 — .json suffix): Alternatively, POST to http://<target>/api/v4/projects/{project_id}/repository/commits.json with a JSON body containing the file.path parameter set to the target file path.

4. Construct bypass request (Method 3 — percent-encoded path): Use URL-encoded path segments such as /api/v4/projects/{id}/repository/%63ommits (where %63 = c) or /api/v4/projects/{id}/%72epository/files/x to evade Workhorse regex matching while Puma decodes the path normally.

5. Send unauthenticated request: Issue the crafted POST or PUT request without any PRIVATE-TOKEN or Authorization header. The GitLab Rails application processes the file.path parameter and opens the specified file before the authentication check is reached.

6. Extract file content from error response: Parse the HTTP response for Rack error messages such as invalid %-encoding (...) which echo file contents, or classify the response verdict (VULNERABLE:content-leak, VULNERABLE:existence-oracle, VULNERABLE:file-exists-not-json) to confirm exploitation. Use regex on the error message to extract the leaked content.

7. Escalate via leaked secrets: Use recovered credentials from files such as gitlab-secrets.json, database.yml, or secrets.yml to authenticate as an administrator, access the database, or pivot to other internal services.

• Network: Unusual POST or PUT requests to /api/v4/projects/*/repository/commits/, /api/v4/projects/*/repository/commits.json, or percent-encoded variants (e.g., /%63ommits, /%72epository/) without authentication headers; requests originating from scanning infrastructure or unfamiliar IPs targeting the GitLab API on ports 80, 443, or 8080/8085.
• Logs: GitLab access logs showing HTTP 400 responses with invalid %-encoding error messages to commits or files API endpoints; repeated unauthenticated POST/PUT requests to repository API paths with file.path parameters containing absolute filesystem paths (e.g., /etc/passwd, /opt/gitlab/, /proc/self/environ).
• File System: No direct file system artifacts from the attacker (read-only exploit), but evidence of subsequent access using leaked credentials (new SSH sessions, unexpected admin logins, database queries from unusual sources).
• Process: Unusual child processes spawned by the GitLab git user following exploitation of leaked SSH keys or credentials; unexpected outbound connections from the GitLab server to attacker-controlled infrastructure.
• Detection Signatures: Qualys detection ID 388702 is available for this vulnerability (Feedly).

GitLab has released patched versions 19.1.8, 19.2.6, and 19.3.2 which remediate this vulnerability; all self-managed GitLab CE/EE administrators should upgrade immediately (CISA KEV, GitHub Advisory). GitLab.com (SaaS) is not affected as it runs the patched version. If immediate patching is not possible, restrict network access to the GitLab API endpoint (particularly the /api/v4/projects/*/repository/commits path) at the firewall or WAF level, and monitor API logs for suspicious unauthenticated requests with file.path parameters. CISA's BOD 26-04 mandates federal agencies remediate by September 14, 2026, and also requires forensic triage of potentially compromised systems (CISA KEV).

The vulnerability generated significant attention across the security community immediately after disclosure, with SecurityWeek, The Hacker News, CyberScoop, and SC World all reporting on active exploitation within one day of the patch release (Feedly). Researchers on Mastodon, Bluesky, and X (via DarkWebInformer) highlighted the rapid weaponization, with watchTowr publishing a rapid-reaction technical analysis. The Hacker News headline — "GitLab CVSS 10 File Read Flaw Draws In-the-Wild Probes After Disclosure" — captured the community's alarm at the speed of exploitation. Reddit threads in r/gitlab and r/SecOpsDaily urged immediate patching, and the vulnerability trended on Hacker News. CISA's same-day KEV listing with a 3-day remediation deadline was widely noted as reflecting the severity of the threat.