GoKawiilAttackers Actively Exploiting Critical GitLab Path Traversal Bug, CVE-2026-85706
A maximum-severity flaw in GitLab's Community and Enterprise editions, patched September 10, is being actively exploited to pull arbitrary files from self-hosted GitLab servers without authentication. WatchTowr researchers say attackers have moved from probing to full exploitation, extracting configuration files, secrets, and SSH settings from compromised systems. CISA has added the bug to its Known Exploited Vulnerabilities list, ordering federal agencies to patch or take affected instances offline.
GoKawiil's interpretation of the reporting above, not reported fact.
Because GitLab hosts source code, credentials, and deployment configurations, this flaw gives attackers a foothold to potentially pivot deeper into corporate networks or poison software supply chains. Read-only access can still expose secrets like SSH keys and passwords, which attackers can chain into further intrusions. The rapid escalation from scanning to active data theft underscores how quickly unpatched instances become targets once a critical CVE is public.
- CVE-2026-85706 is a perfect 10.0 CVSS path traversal flaw in GitLab CE/EE, patched Sept 10.
- Attackers are exfiltrating config files, secrets, and SSH settings from unpatched self-hosted GitLab servers.
- CISA mandated federal agencies patch or disable vulnerable instances, citing active exploitation in the wild.
Source: darkreading.com — Rob Wright, 2026-09-14
Published there as: “Maximum Severity GitLab Flaw Puts Supply Chains at Risk”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.