CISA: Critical GitLab Vulnerability Already Being Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers have begun exploiting a maximum-severity vulnerability in GitLab. The DevSecOps platform is used by more than half of the Fortune 100 companies and has over 30 million registered users worldwide.

What the vulnerability is about

The flaw, assigned the identifier CVE-2026-85706, stems from a missing authentication check and improper path restriction in the repository commits API. An unauthenticated attacker can exploit it to read credentials, secrets and other sensitive information from vulnerable servers — effectively reading an arbitrary file with a single HTTP request.

GitLab fixed the vulnerability on Thursday in the Community Edition and Enterprise Edition releases 19.3.2, 19.2.6 and 19.1, strongly urging users to update immediately.

From patch to exploitation — a matter of days

Although the company itself has not yet flagged the vulnerability as actively exploited, the very next day the firm watchTowr reported that attackers were scanning the internet for unpatched GitLab servers. According to the researchers, probing in the wild is already being observed, and judging by the history of past GitLab vulnerabilities, mass, indiscriminate exploitation is not far off.

Defenders are advised to review their logs for HTTP POST requests to URIs of the form /api/v4/projects/{id}/repository/commits/ that contain a file.path parameter — this may indicate exploitation attempts.

That same day, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to secure their systems within three days under directive BOD 26-04. Although the directive applies only to federal agencies, CISA urged all organizations, including those in the private sector, to update as soon as possible.

“Vulnerabilities of this kind are a frequent attack vector for malicious actors and pose a significant threat to federal infrastructure,” the agency noted, recommending that everyone move to risk-based vulnerability management and prioritize closing the gaps listed in the KEV catalog.

This is not GitLab's first issue this year: in January the company patched a high-severity vulnerability that allowed two-factor authentication to be bypassed if the victim's account ID was known. Since November 2021, CISA has flagged four GitLab vulnerabilities as actively exploited, including two in February of this year.

Source: Bleeping Computer