Maximum Severity GitLab Flaw Puts Supply Chains at Risk
A critical GitLab vulnerability (CVE-2026-85706) is being actively exploited, putting organizations' software supply chains at risk. Threat actors are leveraging this path traversal flaw to steal sensitive data, including credentials and system configurations, potentially leading to a full compromise of GitLab instances and subsequent access to downstream systems. GitLab has released patches, and customers are urged to update immediately or restrict public project access.
A maximum-severity GitLab vulnerability, CVE-2026-85706, is currently being exploited, presenting a significant risk to organizations' software supply chains. This path traversal flaw allows unauthenticated individuals to read arbitrary files from the GitLab server, a capability that has quickly escalated into active exploitation. Cybersecurity vendor watchTowr observed behavioral probes for the vulnerability on its honeypot network, and on Friday, full exploitation and the exfiltration of sensitive files were confirmed.
Threat actors are leveraging this vulnerability to obtain valuable information, including credentials and CI/CD secrets, which could enable a complete compromise of GitLab instances and provide access to an organization's development environment and other critical downstream systems. The vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE), which organizations use to set up self-hosted GitLab instances within their environments.
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog on Friday, requiring federal agencies to patch or disable their self-managed GitLab instances. WatchTowr noted that this is the second critical GitLab vulnerability to be targeted recently, following CVE-2026-19478, a GraphQL code injection flaw, which was exploited shortly after its public disclosure.
GitLab has released patches to mitigate the vulnerability, urging customers to update their self-hosted instances to versions 19.3.2, 19.2.6, or 19.1.8 for GitLab Community Edition and Enterprise Edition. If updates are not possible, organizations should immediately remove all public access to their instances. GitLab Dedicated customers do not require action.
WatchTowr recommends that security teams review access logs on the repository commits API for any suspicious or unauthenticated requests that suggest probing or exploitation activity. The vulnerability’s prevalence – potentially due to organizations exposing public projects – highlights the importance of rigorous access control and regular security audits.