GitLab CVE-2026-85706 — unauthenticated arbitrary file read via the repository commits API (CVSS 10.0), probed in the wild within a day, CISA KEV; same release fixes a CVSS 9.9 Duo Chat credential leak

View raw markdownEdit on GitHub ↗

TL;DR

GitLab's 2026-09-10 critical patch release (19.3.2 / 19.2.6 / 19.1.8) fixes CVE-2026-85706: a path-traversal in the repository commits API that lets an unauthenticated attacker read arbitrary files the GitLab service account can reach — logs and configuration holding credentials, secrets and tokens — in a single HTTP request. GitLab scored it CVSS 3.1 10.0; NVD published the same score on 2026-09-12. watchTowr saw in-the-wild probing from 06:00 UTC on 2026-09-11, one day after disclosure, and CISA added it to KEV the same day with a federal remediation deadline of 2026-09-14. Affected: CE/EE 18.7 → 19.1.7, 19.2.0 → 19.2.5, 19.3.0 → 19.3.1. GitLab.com and Dedicated are already patched. The same release fixes CVE-2026-87719 (CVSS 9.9): an authenticated user with Duo Chat access could pull Advanced Search configuration and credentials through a crafted GraphQL subscription.

What happened

GitLab's patch post describes CVE-2026-85706 as "improper path confinement combined with missing authentication enforcement" in the commits API. watchTowr's rapid-reaction analysis identifies the surface as POST /api/v4/projects/{id}/repository/commits/ with file.path parameters, and The Hacker News (citing watchTowr) adds the one precondition: at least one public project must exist on the instance — which is true of most self-managed GitLabs that host anything open-source or any "public" internal sample. What is readable is whatever the GitLab service account can open: GitLab-specific configuration and log files containing credentials, secrets and access tokens, per watchTowr and SecurityWeek. On a self-managed instance that is the host for your source, your CI/CD variables, your runners' registration tokens, and often your deploy keys.

The release fixes 19 CVEs in total. Beyond the headline:

  • CVE-2026-87719 (CVSS 9.9, EE 18.3 → same fixed versions) — an authenticated user with Duo Chat access could obtain Advanced Search instance configuration and sensitive credentials via a specially crafted GraphQL subscription. Duo Chat is GitLab's AI assistant; this is another instance of an AI feature widening a reachable surface (compare PyCharm's unauthenticated Jupyter MCP).
  • A buffer overflow in Unicode conversion (CVSS 8.5), a Developer-role privilege escalation to CI/CD variables (CVSS 8.5), GraphQL complexity-limiter DoS bugs (7.5), and protected-environment authorisation bypasses (4.4) — per GitLab's release notes.

Exploitation timeline: patch and advisory 2026-09-10 → watchTowr probes 2026-09-11 06:00 UTC → CISA KEV 2026-09-11 (confirmed directly in the KEV JSON feed: dateAdded 2026-09-11, "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability") → NVD record 2026-09-12. A one-day disclosure-to-probing gap on a CVSS 10 file read against source-hosting infrastructure is the same shape as the JFrog Artifactory chain added to KEV on the same day.

Am I affected?

Only self-managed GitLab. GitLab.com and GitLab Dedicated need no action.

# Version check (any of these)
sudo gitlab-rake gitlab:env:info 2>/dev/null | grep -i 'GitLab information' -A2
curl -s -H "PRIVATE-TOKEN: $GITLAB_TOKEN" https://gitlab.example.com/api/v4/version
# Vulnerable if: 18.7 <= v < 19.1.8, or 19.2.0 <= v < 19.2.6, or 19.3.0 <= v < 19.3.2

# Hunt for probing/exploitation (watchTowr's guidance): unauthenticated POSTs to the commits API carrying file.path
grep -E 'POST .*/api/v4/projects/[^/]+/repository/commits/?' /var/log/gitlab/gitlab-rails/api_json.log 2>/dev/null | grep -i 'file.path' | head
grep -E '/repository/commits' /var/log/gitlab/nginx/gitlab_access.log 2>/dev/null | grep POST | head

If you find matching requests from addresses you do not recognise before you patched, assume every secret the GitLab host holds has been read.

If you are affected

  1. Upgrade to 19.3.2 / 19.2.6 / 19.1.8 now. The release includes database migrations; single-node instances will see downtime. If you cannot upgrade today, take the instance off the public internet until you can.
  2. If exploitation is suspected, rotate what GitLab's host and database hold — runner registration tokens, CI/CD variables (especially group/instance-level cloud credentials), deploy keys, integration tokens, and the instance's own secrets — and re-issue personal access tokens: → playbooks/rotating-cloud-credentials.md, → playbooks/if-your-github-pat-leaked.md (the token-rotation steps translate directly).
  3. Review Duo Chat access if you run EE ≥ 18.3: CVE-2026-87719 needs an authenticated user, so audit which accounts had it and whether any are shared or automation identities.

Prevention

  • → prevention/ci-cd-hardening.md — keep cloud credentials out of instance-level CI variables; use OIDC federation from runners so a file read on the GitLab host does not yield long-lived keys.
  • → prevention/credential-hygiene.md
  • Do not expose self-managed source hosting to the whole internet if you can avoid it; when you must, put it behind SSO/VPN or an allow-list. This bug needed no account — only reachability plus one public project.
  • Subscribe to GitLab's patch-release feed and treat "critical patch release" as a same-day action: the probing started about 24 hours after the post.

Sources