# A perfect 10 GitLab bug is already under attack

> CISA put a 10/10 GitLab path traversal flaw on its must-patch list after researchers spotted live probes.
- Title: A perfect 10 GitLab bug is already under attack · TechRadar
- Summary: CISA put a 10/10 GitLab path traversal flaw on its must-patch list after researchers spotted live probes. Update GitLab to 19.3.2, 19.2.6, or 19.1 now, then…
- Keywords: gitlab, cisa, vulnerability, devsecops, patching, technology, breaking, perfect, bug, already, under, attack
- Source: TechRadar — https://techradar.com/pro/security/cisa-warns-hackers-are-exploiting-max-severity-gitlab-flaw-urges-all-businesses-to-patch-immediately
- Published: 2026-09-14T16:50:00+00:00
- Read time: 1 min
- Topics: gitlab, cisa, vulnerability, devsecops, patching, technology, breaking
## CISA sounds the alarm
The US Cybersecurity and Infrastructure Security Agency added a new GitLab vulnerability to its Known Exploited Vulnerabilities catalog, confirming attackers are already using it.
## Two critical holes patched
GitLab shipped fixes across Community and Enterprise Edition 19.3.2, 19.2.6, and 19.1. Two of the bugs were critical: a path traversal in the commits API and insecure deserialization in a GraphQL serializer.
## Scored a flat 10 out of 10
CVE-2026-85706 comes from missing authentication and sloppy path confinement in the repository commits API. Unauthenticated attackers can read credentials and secrets straight off the server.
## Probes already in the wild
GitLab's advisory said nothing about real-world abuse. A day later, security firm watchTowr reported it was watching attackers scan for the flaw, which needs just one HTTP request.

> watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab Path Traversal vulnerability
## Go hunt your logs
watchTowr says mass exploitation usually follows fast. Defenders should search logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ that contain a file.path parameter.

> the time until indiscriminate exploitation is likely not far away
## Three days to patch
Federal agencies got a tight three-day deadline. The blast radius is wide: GitLab claims over 50 million registered users and roughly half the Fortune 100 as customers.
## Key takeaway

Update GitLab to 19.3.2, 19.2.6, or 19.1 now, then search your logs for POST requests to the commits API carrying a file.path parameter.