{"id":9487,"date":"2026-09-15T00:52:55","date_gmt":"2026-09-15T00:52:55","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9487"},"modified":"2026-09-15T00:52:55","modified_gmt":"2026-09-15T00:52:55","slug":"a-maximum-severity-gitlab-flaw-could-turn-your-ci-cd-server-into-an-attackers-treasure-trove","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9487","title":{"rendered":"A maximum severity GitLab flaw could turn your CI\/CD server into an attacker\u2019s treasure trove"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Yet another security vulnerability has been discovered in GitLab infrastructure, this one a perfect 10 in severity.<\/p>\n

CVE-2026-85706<\/a>, the second flaw<\/a> GitLab has disclosed in just a month, is a maximum-severity vulnerability that allows attackers to read arbitrary files in a single HTTP request. The path traversal flaw results from improper confinement and lack of authentication enforcement in GitLab\u2019s repository commits API, the company reported.<\/p>\n

Threat actors could exploit it \u201cunder certain conditions\u201d and read arbitrary files (credentials, secrets, and other sensitive data) on vulnerable GitLab servers.<\/p>\n

The company has fixed the vulnerability, which impacts GitLab Community Edition (CE) and Enterprise Edition (EE), and has advised customers with public-facing self-hosted GitLab instances to patch their servers immediately, or remove public access.<\/p>\n

Experts say the flaw is alarming because GitLab\u2019s DevSecOps platform is used by roughly 50% of the Fortune 100 and has more than 50 million<\/a> estimated registered users.<\/p>\n

\u201cGitLab is not simply a source-code repository,\u201d noted Safayat Moahamad<\/a>, advisory director at Info-Tech Research Group. In many enterprises, it is connected to build pipelines, deployment processes, application security workflows, and other trusted systems.<\/p>\n

As a result, unauthorized access to configuration files, secrets, or credentials on the GitLab server could \u201ccreate consequences well beyond the affected instance,\u201d he said.<\/p>\n

Don\u2019t wait for the normal patch cycle<\/h2>\n

GitLab has been a favorite hacker target of late: In January, it patched a high-severity flaw<\/a> that allowed attackers possessing a target\u2019s account ID to bypass two-factor authentication, and in August, it fixed a critical vulnerability<\/a> that could give unauthenticated users the ability to make modifications inside code repositories or even completely delete them with a single HTTP request.<\/p>\n

The current maximum severity bug, CVE-2026-85706<\/a>, was reported through GitLab\u2019s HackerOne bug bounty program. It affected CE and EE versions 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.<\/p>\n

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog, noting that this type of vulnerability is a frequent attack vector for malicious cyber actors, and particularly poses significant risks to the federal enterprise; watchTowr Intel<\/a> has reported that it is already observing \u201cin-the-wild probes.\u201d \u201cBased on recent GitLab vulnerabilities, we know the time until indiscriminate exploitation is likely not far away,\u201d it warned.<\/p>\n

This is not a vulnerability that organizations should leave for the normal patch cycle, Moahamad emphasized. \u201cIt offers an unauthenticated path to arbitrary files on a platform that frequently sits at the center of source code, build, and deployment workflows,\u201d he said.<\/p>\n

Enterprises should patch immediately, hunt for suspicious repository-commits API activity, and investigate whether exposed files contained credentials or secrets that may now require rotation, he advised.<\/p>\n

Beyond patching, the watchTowr Intel team said defenders should try to identify exploitation attempts by hunting through log files for HTTP POST requests to \u201c\/api\/v4\/projects\/{id}\/repository\/commits\/<\/em>\u201d URIs containing \u201cfile.path<\/em>\u201d parameters.<\/p>\n

CI\/CD platforms are critical trust infrastructure\u00a0<\/h2>\n

Organizations running affected self-managed GitLab CE or EE instances should be most concerned, Moahamad noted. Risk increases where GitLab is connected to sensitive repositories, CI\/CD pipelines, cloud environments, or production-deployment processes.<\/p>\n

The information and\/or access that attackers could obtain depends on what the GitLab service can read and what organizations store on the server, he explained. It could include configuration files, secrets, credentials<\/a>, and other sensitive server-side data. If those files happen to contain usable tokens, keys, or credentials, an attacker could attempt to access connected infrastructure<\/p>\n

\u201cThe flaw directly creates an unauthorized file access risk,\u201d he said. Credential theft, lateral movement, source code exposure, and supply chain compromise are possible follow-on scenarios.<\/p>\n

Source code and CI\/CD platforms must be governed as \u201ccritical trust infrastructure,\u201d he said. While patching remains essential, resilience will depend on knowing where platforms can be exposed, limiting what they can access, detecting abnormal API behavior, and having a tested process for investigating and rotating credentials.<\/p>\n

David Shipley<\/a> of Beauceron Security described two factors colliding to generate \u201cmaximum pain\u201d for GitLab users.<\/p>\n

First is the vulnerability. \u201cIt\u2019s a 10 for a reason: Unauthenticated read access to GitLab client source code,\u201d he said.<\/p>\n

Second, this especially hurts because developers still have bad habits: way too much code continues to ship or is in production with embedded SSH keys, cloud secrets, tokens, and other valuable data that attackers can use to get into infrastructure, Shipley said.<\/p>\n

\u201cSo for attackers, you\u2019ve got the classics,\u201d he noted: Data exfiltration and extortion, ransomware, cloud infrastructure hijacking for crypto mining, and the stealing of AI tokens and infrastructure to enable other criminal activity.<\/p>\n

\u201cThis level of vulnerability is the code and cloud equivalent of being able to get the credit card number, expiry and security number,\u201d Shipley said. \u201cIt opens up a world of criminal data shopping.\u201d<\/p>\n

The bottom line: \u201cGet those secrets out of production code and adopt modern coding authentication best practices,\u201d he advised.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Yet another security vulnerability has been discovered in GitLab infrastructure, this one a perfect 10 in severity. CVE-2026-85706, the second flaw GitLab has disclosed in just a month, is a maximum-severity vulnerability that allows attackers to read arbitrary files in a single HTTP request. The path traversal flaw results from improper confinement and lack of […]<\/p>\n","protected":false},"author":0,"featured_media":9488,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9487","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9487"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9487"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9487\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9488"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9487"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}