Security Brief/Report

GitLab patches maximum-severity path traversal flaw, urges self-managed users to upgrade

GitLab released fixes for a maximum-severity path traversal vulnerability, CVE-2026-85706, and a second critical flaw, CVE-2026-87719. The company urged self-managed installations to upgrade immediately, while a security firm reported early scanning for exposed servers.

ReportPublished 12 September 20261 min read1 linked source · 9 checked facts

stack of network switches with status LEDs in a rack — Illustration: Network switches arranged in a server rack with visible LED lights indicating connection status and power levels · Shixart1985 · CC BY 2.0 licence

GitLab has released patches for a maximum-severity path traversal vulnerability tracked as CVE-2026-85706, and urged users to update their servers immediately. The flaw stems from improper path confinement and missing authentication enforcement in the repository commits API. According to GitLab, unauthenticated attackers can exploit it "under certain conditions" to read arbitrary data, such as credentials, secrets, and sensitive information, from vulnerable servers. The company has not flagged the flaw as exploited in the wild.

Who is exposed? Self-managed GitLab installations that have not applied the fixes. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action. The fixed versions are GitLab Community Edition (CE) and Enterprise Edition (EE) 19.3.2, 19.2.6, and 19.1. GitLab strongly recommends that all self-managed installations upgrade to one of these versions immediately.

The protective step is straightforward: upgrade to a patched version. Additionally, watchTowr reported that attackers have begun searching for internet-exposed GitLab servers unpatched against CVE-2026-85706. The firm warned that indiscriminate exploitation is likely not far away, based on recent GitLab vulnerabilities. Defenders can hunt through log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters to identify potential exploitation attempts.

GitLab also patched a second critical vulnerability, CVE-2026-87719, which affects GitLab EE and stems from an insecure deserialization weakness in the GraphQL subscription serializer. It allows authenticated users with Duo Chat access to steal sensitive credentials and Advanced Search instance configurations. The two flaws were fixed in the same release. Historically, GitLab has dealt with similar path traversal issues, including a maximum-severity flaw in May 2023 (CVE-2023-2825). Since November 2021, CISA has flagged four GitLab vulnerabilities as exploited in attacks.

What the reporting says

Each line below is stated by the page named above it, and only by that page.

Stated by BleepingComputer

GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706.
The flaw stems from improper path confinement and missing authentication enforcement in the repository commits API.
Unauthenticated attackers can exploit CVE-2026-85706 "under certain conditions" to read arbitrary data (e.g., credentials, secrets, and sensitive information) from vulnerable servers.
GitLab fixed the two security issues in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.3.2, 19.2.6, and 19.1.
GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.
watchTowr reported that attackers have already begun searching for Internet-exposed GitLab servers unpatched against CVE-2026-85706.
Defenders should also hunt through log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters to identify potential exploitation attempts.
GitLab patched a second critical vulnerability tracked as CVE-2026-87719 that stems from an insecure deserialization weakness in the GraphQL subscription serializer.
CVE-2026-87719 affects GitLab EE and allows authenticated users with Duo Chat access to steal sensitive credentials and Advanced Search instance configurations.

Our view

Self-managed GitLab administrators should treat this as an urgent patch-or-be-scanned situation, given watchTowr's early probes and GitLab's history of path traversal flaws being targeted.

What the reporting says: GitLab stated that unauthenticated attackers can exploit CVE-2026-85706 "under certain conditions" to read arbitrary data, and that it has yet to flag the flaw as exploited in the wild.

Sources

BleepingComputerPublished 12 September 2026 · checked 14 September 2026

Found through monitored feeds: BleepingComputer. A feed address is how the desk finds a story, not the evidence for it — the sources listed above are the pages the facts were taken from.

How this story was checked

This story was written from the 1 page listed above, all read on 14 September 2026.
Every figure and identifier in the text was required to appear in that source text before publication; any that did not was removed rather than checked by memory.
Of the 9 reported statements recorded for this story, 9 are each traceable to a linked page and are shown above. The rest were dropped.
Quantities traced to the source text: yes; identifiers traced: yes.
Where the reporting was silent, the text says so instead of filling the gap. This is a reported story, not a review of the source.

GitLab patches maximum-severity path traversal flaw, urges self-managed users to upgrade

What the reporting says

Our view

Sources

More from Security Brief

MikroTik SSH authentication bypass exploited; patch released

Microsoft's September 2026 Patch Tuesday Fixes Record 973 Vulnerabilities

China-aligned group exploits Tencent Sogou Input Method flaw, deploys GrayRabbit backdoor

How this story was checked