GoKawiilCISA confirms active exploitation of critical GitLab path traversal flaw CVE-2026-85706
CISA has added a maximum-severity GitLab vulnerability, CVE-2026-85706, to its known exploited vulnerabilities catalog after security firm watchTowr detected attackers scanning the internet for unpatched servers. The flaw allows unauthenticated attackers to read credentials and sensitive files from GitLab instances via a single crafted HTTP request to the repository commits API. GitLab patched the issue in versions 19.3.2, 19.2.6, and 19.1, but federal agencies now have just three days to remediate under a binding directive.
GoKawiil's interpretation of the reporting above, not reported fact.
GitLab powers DevOps workflows for more than half of Fortune 100 companies and 30 million users, making this a high-value target capable of exposing secrets and credentials at massive scale. The rapid shift from patch release to active exploitation underscores how little time organizations have to remediate critical vulnerabilities before attackers weaponize them.
- CVE-2026-85706 lets unauthenticated attackers steal credentials via path traversal in GitLab's commits API
- CISA confirmed active exploitation and gave federal agencies 3 days to patch under BOD 26-04
- All organizations, not just government, are urged to update to GitLab 19.3.2, 19.2.6, or 19.1 immediately
YubiKey 5 NFC Security Key — When credential-stealing flaws like this GitLab bug hit, leaked passwords and tokens are the real prize — hardware-backed MFA makes stolen secrets far less useful. The YubiKey 5 NFC plugs into USB-A or taps via NFC and works with GitLab, GitHub, Google, and countless other accounts. It's a simple physical step toward locking down developer logins.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-14
Published there as: “CISA: Hackers now exploit max severity GitLab flaw in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.