Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-85706 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-11 |
| Vendor | GitLab |
| Product | Community Edition and Enterprise Edition |
| CVSS Score | 10.0 (critical) |
| EPSS Score | 14.6% (percentile: 96%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-14 |
Vulnerability Description
Source: CISA KEV
GitLab Community Edition and Enterprise Edition contain a path traversal vulnerability — escaping the intended directory through path manipulation.
Two defects combine in the repository commits API: improper path confinement and missing authentication enforcement. As a result, an unauthenticated user can read arbitrary files.
The significance for an organisation goes beyond file reads. Repositories and their surroundings are a common home for secrets — access keys, connection strings, CI/CD tokens. Unauthenticated arbitrary file read is therefore best treated as a possible stepping stone to further access, not as an event contained within one system.
CVSS 10.0 is the top of the scale. The entry appears in the CISA KEV catalog as actively exploited, and the assigned remediation deadline of 2026-09-14 has passed.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects organisations running GitLab Community Edition or Enterprise Edition.
Check your instance version against GitLab’s security advisory. Internet-reachable instances deserve particular attention — including those spun up “just for a moment” for an external contractor or a single project. Because the vector requires no authentication, network exposure alone is enough for an attempt.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
