The post has been translated automatically. Original language: English
On September 10, 2026, GitLab closed the CVE vulnerability-2026-85706 — path traversal in the repository commits API with a maximum CVSS score of 10.0. The problem allowed an unidentified attacker to read arbitrary files on self-managed servers with a single HTTP request, including source code, tokens, SSH keys, and CI/CD variables.
The vulnerability affected GitLab CE/EE versions from 18.7 to 19.1.8, 19.2 to 19.2.6, and 19.3 to 19.3.2. The worst part is that exploitation in real attacks began within 24 hours of disclosure — the American agency CISA has already issued an emergency warning.
This is no longer an isolated case: in August, GitLab closed an equally critical hole in GraphQL (CVE-2026-19478, 9.4 points), which also began to be exploited a few days after the patch was published. Experts note an alarming trend — with the advent of AI tools for code analysis, the time between vulnerability disclosure and the first real attack is reduced to hours, not weeks.
If you have a self-managed GitLab, it's time to check the version and logs for signs of compromise, and rotate all tokens and keys that could "light up".
On September 10, 2026, GitLab closed the CVE vulnerability-2026-85706 — path traversal in the repository commits API with a maximum CVSS score of 10.0. The problem allowed an unidentified attacker to read arbitrary files on self-managed servers with a single HTTP request, including source code, tokens, SSH keys, and CI/CD variables.
The vulnerability affected GitLab CE/EE versions from 18.7 to 19.1.8, 19.2 to 19.2.6, and 19.3 to 19.3.2. The worst part is that exploitation in real attacks began within 24 hours of disclosure — the American agency CISA has already issued an emergency warning.
This is no longer an isolated case: in August, GitLab closed an equally critical hole in GraphQL (CVE-2026-19478, 9.4 points), which also began to be exploited a few days after the patch was published. Experts note an alarming trend — with the advent of AI tools for code analysis, the time between vulnerability disclosure and the first real attack is reduced to hours, not weeks.
If you have a self-managed GitLab, it's time to check the version and logs for signs of compromise, and rotate all tokens and keys that could "light up".
Share
