GitLab CVE-2026-85706: Patch to 19.1.8/19.2.6/19.3.2 — Unauthenticated Arbitrary File Read, Already Exploited

If you run GitLab on your own servers, an attacker who has not authenticated at all can read arbitrary files from that server. This is CVE-2026-85706. GitLab attributes it to improper path confinement combined with missing authentication enforcement in the repository commits API.

This is already being exploited. On 11 September 2026, CISA added it to the Known Exploited Vulnerabilities (KEV) catalog.

There is one thing to do: upgrade to 19.1.8, 19.2.6 or 19.3.2 now.

Do this now

• ✓First, check whether this is even yours to fix. GitLab states that GitLab.com already runs the patched version and GitLab Dedicated customers need take no action. Only self-managed installations are affected.
• ✓Check your version. The admin Help page (`/help`) shows it. Affected ranges are 18.7 up to but not including 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Anything older than 18.7 is also not a fixed release, so upgrade it the same way.
• ✓Upgrade to 19.1.8, 19.2.6 or 19.3.2, whichever matches your branch. GitLab says affected installations should be upgraded immediately.
• ✓There is no official workaround. The release page lists no configuration change or WAF rule as a mitigation. Upgrading is the only remedy the vendor publishes, which leaves no real option to defer.
• ✓Start with instances exposed directly to the internet. The attack needs no credentials, so anything reachable from outside is the most urgent.

Where this score comes from matters. The 10.0 is GitLab's own assessment as the CNA, on CVSS v3.1 (vector `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`).

As of 14 September 2026, NVD still lists the record as "Undergoing Analysis" and NIST has not published its own score. The 10.0 shown on the NVD page is GitLab's value. NIST may publish a different number later.

Not "could be exploited" — it is being exploited

This is the part that should drive your timeline. Exploitation is confirmed by a government agency, not inferred.

CISA added the CVE to KEV on 11 September 2026 and set a remediation deadline of 14 September 2026 for US federal civilian agencies. CISA's published SSVC decision (dated 12 September 2026, CISA Coordinator) reads:

exploitation: active / automatable: yes / technicalImpact: total

Those three together mean attacks are live and can be run against large numbers of servers mechanically. The deadline binds US federal agencies rather than anyone else, but the exploitation is a fact regardless of where you are.

What can be read

GitLab's wording is that an attacker could read arbitrary files from the GitLab server. It is a read, not a write and not code execution. But a GitLab server holds configuration files and credentials alongside source code, so a read-only flaw can still be a stepping stone.

The weakness is classified as CWE-22 (path traversal) by NVD and CWE-35 (relative path traversal) by CISA — both describe files being pulled out from outside their intended directory via a crafted path.

GitLab credits s3ntago for reporting the issue through its HackerOne bug bounty programme.

Affected and fixed versions

• ▸Affected (CVE-2026-85706): GitLab CE/EE from 18.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
• ▸Fixed in: 19.1.8, 19.2.6, 19.3.2, released 10 September 2026
• ▸No action needed: GitLab.com (already patched) and GitLab Dedicated (stated explicitly by GitLab)
• ▸The release fixes 18 CVEs in total, two of them Critical including this one (the 18 include older identifiers such as CVE-2024-11222 and CVE-2025-14871)
• ▸KEV: added 11 September 2026 / due date: 14 September 2026 (US federal civilian agencies)

The other Critical fixed in the same release

CVE-2026-87719 (9.9 on CVSS v3.1, GitLab's assessment) ships in the same update.

It affects GitLab EE only. An authenticated user with Duo Chat access can use a crafted GraphQL subscription argument to bypass serialization and retrieve Advanced Search instance configuration along with sensitive credentials. Affected ranges are 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.

It is less urgent than CVE-2026-85706 because it needs an account, but the fixed versions are the same, so one upgrade closes both.

If it was internet-facing, patching is not the end

CISA flags this CVE as subject to forensic triage. Upgrading closes the door; it does not undo reads that already happened. If the instance was reachable from outside, check the following after upgrading.

• ✓Search access logs for unusual requests to the repository commits API — odd path arguments, or runs of unauthenticated access.
• ✓Inventory the credentials that were sitting on that server. Because the flaw allowed reading arbitrary files, the safe assumption is that secrets present before the upgrade may have been read.
• ✓Rotate tokens and keys if anything looks wrong. When logs cannot tell you how far an attacker got, rotation is the most reliable way to close it out.
• ✓None of this applies if you only use GitLab.com or Dedicated. The exposure is limited to self-managed instances.

GitLab normally batches patches on the second and fourth Wednesday of each month and ships ad-hoc releases for high-severity issues. This one was an ad-hoc Critical Patch Release. If you self-manage GitLab, subscribing to these release announcements will shorten your reaction time next time.