GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
Executive & SecOps Summary
SECOPS ASSESSMENTGitLab CE/EE versions from 18.7 through 19.3.1.
Unauthenticated remote attackers can read arbitrary files from the server, potentially leading to full system compromise and credential theft.
Immediate upgrade to patched versions: 18.11.12, 19.0.9, 19.1.8, 19.2.6, or 19.3.2.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUNDImmediate patching is the only definitive remediation.
1. Upgrade via Package Manager
# For GitLab EE on Ubuntu
sudo apt-get update && sudo apt-get install gitlab-ee2. WAF Mitigation
If immediate patching is not possible, implement WAF rules to block suspicious traversal patterns in API requests:
- Block requests containing
..%2for..%5ctargeting the/api/v4/projects/endpoint.
3. Incident Response
Review production_json.log for unauthorized access to the Commits API with path traversal payloads.
grep -E "\.\.%2f|\.\./" /var/log/gitlab/gitlab-rails/production_json.logScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
CVE-2026-85706 is a critical vulnerability involving improper path confinement (CWE-22) and missing authentication enforcement in the GitLab Repository Commits API. An attacker can bypass directory restrictions by injecting traversal sequences into API requests, allowing them to read sensitive configuration files (e.g., gitlab.rb, database secrets). With a CVSS score of 10.0 and inclusion in the CISA KEV catalog, this vulnerability represents a maximum-severity threat that is actively being exploited in the wild.
Official Vendor Advisories & References
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.