A single HTTP POST request to the /api/v4/projects/{id}/repository/commits/ endpoint is sufficient to bypass security controls and read arbitrary files from a GitLab server. This path traversal vulnerability, designated CVE-2026-85706, carries a CVSS score of 10.0. It stems from a failure in path confinement combined with a complete lack of authentication enforcement. To trigger the exploit, an attacker only needs to target a GitLab instance that hosts at least one public project.
The vulnerability was reported by s3ntago via the HackerOne bug bounty program. GitLab released patches for affected versions – CE/EE versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 – on September 10, 2026. While GitLab.com is patched, the risk remains for the estimated 20,000-plus self-managed instances globally.
Probing activity began shortly after disclosure. The watchTowr honeypot network observed in-the-wild exploitation attempts at 06:00 UTC on September 11, 2026. The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on the same day, mandating remediation by September 14 under BOD 26-04.
Jake Knott, head of threat intelligence at watchTowr, notes that this is the second critical-severity GitLab vulnerability in recent weeks, following the GraphQL code injection (CVE-2026-19478) that saw near-immediate active exploitation. Regarding the current threat, Knott states: “The appeal to attackers of GitLab is obvious, as unauthorized access allows an attacker to gain access to source code, CI/CD secrets, credentials, and the ability to inject code into build pipelines, gaining access or poisoning anything downstream of it.”
The blast radius extends beyond the immediate server filesystem. Because GitLab functions as the backbone for enterprise CI/CD pipelines, a compromise provides an entry point for supply-chain attacks. The integration of agentic AI coding agents – such as Cursor, Copilot, and Claude – compounds this risk. These agents operate within repositories and pipelines, often inheriting the credentials of the environment. If a GitLab instance is compromised, these agents may inadvertently expose those credentials, allowing an attacker to move laterally or poison build pipelines, creating downstream effects that are difficult to detect.
This is the second CVSS 10 path traversal vulnerability in GitLab within three years. The previous instance, CVE-2023-2825, involved the uploads endpoint in nested public projects and was patched in May 2023. While the specific API endpoints differ, the root cause – a failure in path confinement – is consistent. Two maximum-severity path traversals in three years, each in a different API surface, suggests a structural problem in how the platform handles untrusted file paths.
CVE-2026-85706 was part of a larger batch of 17 vulnerabilities addressed on September 10. Other notable flaws include CVE-2026-87719, an insecure deserialization issue in the GraphQL subscription serializer (CVSS 9.9) that could expose Advanced Search configurations and credentials through Duo Chat, and CVE-2026-88765, a buffer overflow in the Unicode conversion wrapper (CVSS 8.5) enabling remote code execution via crafted Git project exports. CVE-2026-12910, a SAML SSO bypass allowing authenticated users to circumvent sign-in restrictions, was also included.
Security teams should hunt for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ URIs containing file.Path parameters – a strong indicator of exploitation attempts. Given the speed of weaponization observed by watchTowr’s honeypot network, patching self-managed instances to 19.3.2, 19.2.6, or 19.1.8 is the only reliable mitigation before the September 14 CISA deadline.