CISA sounds the alarm

The US Cybersecurity and Infrastructure Security Agency added a new GitLab vulnerability to its Known Exploited Vulnerabilities catalog, confirming attackers are already using it.

Two critical holes patched

GitLab shipped fixes across Community and Enterprise Edition 19.3.2, 19.2.6, and 19.1. Two of the bugs were critical: a path traversal in the commits API and insecure deserialization in a GraphQL serializer.

Scored a flat 10 out of 10

CVE-2026-85706 comes from missing authentication and sloppy path confinement in the repository commits API. Unauthenticated attackers can read credentials and secrets straight off the server.

Probes already in the wild

GitLab's advisory said nothing about real-world abuse. A day later, security firm watchTowr reported it was watching attackers scan for the flaw, which needs just one HTTP request.

“watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab Path Traversal vulnerability”

Go hunt your logs

watchTowr says mass exploitation usually follows fast. Defenders should search logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ that contain a file.path parameter.

“the time until indiscriminate exploitation is likely not far away”

Three days to patch

Federal agencies got a tight three-day deadline. The blast radius is wide: GitLab claims over 50 million registered users and roughly half the Fortune 100 as customers.