Perfect-10 GitLab bug under attack days after patch lands

1. Executive summary

GitLab patched CVE-2026-85706 — a CVSS 10.0 CRITICAL path traversal (CWE-22) in the repository commits API of GitLab Community Edition and Enterprise Edition — on 2026-09-10, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-11 on evidence of active exploitation (EPSS 11%). The flaw allows an unauthenticated attacker to read arbitrary files from an affected self-managed GitLab server, and exploitation is reported to be a single HTTP request. Any EMEA financial services firm running an internet-facing self-managed GitLab CE/EE instance in the affected version ranges (18.7 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2) should treat this as an emergency: the exposed data is source code, configuration and credentials, and the same patch release also fixes a CVSS 9.9 insecure deserialization flaw in GitLab EE (CVE-2026-87719). GitLab.com and GitLab Dedicated are already remediated and require no client action.

2. Regulatory framing

No NIS2 or UK NIS 2018 article in the reference is specifically engaged by this item on the facts available.

3. Technical analysis & attack chain

Confirmed attack chain

1. Attacker identifies an internet-facing self-managed GitLab CE/EE instance running an affected version (18.7 before 19.1.8, 19.2 before 19.2.6, or 19.3 before 19.3.2).
2. Attacker sends a single HTTP POST request to the repository commits API endpoint /api/v4/projects/{id}/repository/commits/ carrying a file.path parameter.
3. No authentication is required: GitLab attributes the flaw to improper path confinement combined with missing authentication enforcement in the affected API.
4. The crafted file.path value escapes the intended directory and the server returns the contents of arbitrary local files — source code, configuration data, credentials and other secrets.

Vulnerability mechanism. CVE-2026-85706 is a path traversal (CWE-22) in the repository commits API. The two defects compound: the path is not confined to the intended repository scope, and the API does not enforce authentication before processing the request. The result is unauthenticated arbitrary file read on a platform that routinely holds source code, CI/CD configuration and credentials. The verified reference data records CVSS 10.0 CRITICAL, CWE-22, CISA KEV status (added 2026-09-11) and EPSS 11%; the source material is consistent with this and no classification discrepancy was identified.

Affected and fixed versions.

All self-managed deployment types are affected — Omnibus, source code and Helm chart. GitLab.com is already running a patched version and GitLab Dedicated customers do not need to take action.

Patch mechanics. The updates include database migrations. Single-node installations will experience downtime while migrations run; multi-node deployments can use GitLab's zero-downtime upgrade procedure. Of the three fixed releases, only 19.3.2 includes post-deployment migrations.

Other vulnerabilities in the same release. The patch release also addresses 17 other vulnerabilities, including CVE-2026-87719 — a critical insecure deserialization flaw (CWE-502) in GitLab EE with CVSS 9.9. Per GitLab, an authenticated user with Duo Chat access could, under certain conditions, obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument. At the time of publication only CVE-2026-85706 is known to be exploited in the wild.

Exploitation status and confidence caveats. CISA's KEV listing is the authoritative confirmation of exploitation. The specific observation of in-the-wild probes is attributed to watchTowr and is single-sourced; verify before relying on it for enforcement decisions — no second vendor in the supplied material independently reports probe telemetry. No threat actor is named in any source, and the verified reference data contains no MITRE ATT&CK profile for this activity: attribution is unconfirmed. CISA's KEV entry records known ransomware campaign use as "Unknown" — there is no basis to describe this as ransomware activity.

4. Mitigation & containment

P1 — within 24 hours

• Upgrade every self-managed GitLab CE/EE instance to 19.1.8, 19.2.6 or 19.3.2 (choose the fixed release on your current branch). This is the vendor-supplied remediation and the only complete fix.
• If you cannot patch immediately, remove internet-facing exposure: take the instance off public access or restrict it at the network edge. watchTowr's explicit advice for internet-facing self-hosted instances is to patch or pull them from public access.
• Hunt for exploitation attempts in web/proxy and GitLab logs: HTTP POST requests to /api/v4/projects/{id}/repository/commits/ containing file.path parameters.
• If any such request is found on an unpatched instance, treat the host as compromised and begin forensic triage — CISA's KEV entry carries forensic triage requirements under BOD 26-04 (which applies directly only to FCEB agencies, but is a sound baseline).

P2 — within 72 hours

• Rotate credentials and secrets reachable from any GitLab host with evidence of exploitation: repository and CI/CD tokens, deploy keys, database credentials, and any secrets held in configuration data on the server.
• Complete the compromise assessment across all self-managed instances, including those not internet-facing, since the flaw is unauthenticated and internal exposure still counts.
• Confirm patch state by version inventory rather than by change ticket — the affected ranges are version-specific and a partially upgraded fleet is the common failure mode here.

P3 — within 7 days

• Patch the remaining 17 vulnerabilities in the same release, prioritising CVE-2026-87719 (GitLab EE, CVSS 9.9, authenticated Duo Chat user, GraphQL subscription argument) — it is not known-exploited but exposes instance configuration and credentials.
• Plan the upgrade window around the migration behaviour: single-node installs take downtime; multi-node installs can use the zero-downtime procedure; only 19.3.2 carries post-deployment migrations.
• Where exposure management tooling is in use, Rapid7 shipped a vulnerability check for CVE-2026-85706 in its September 15 content release (Exposure Command, InsightVM, Nexpose).

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

No atomic indicators (hashes, domains, IPs, file paths) are present in the supplied sources, so no copyable indicator block is provided.

6. Detection

No file-level artefacts (hashes, filenames, registry keys, mutexes, ransom-note strings) are present in the sources, so no YARA rule is emitted. The usable artefact is the request pattern, which belongs in log detection:

title: GitLab Repository Commits API Path Traversal Exploitation Attempt (CVE-2026-85706)
id: 8f2c1a44-7d3e-4b91-9c0a-6e5b2d7a1f30
status: experimental
description: >
  Detects HTTP POST requests to the GitLab repository commits API carrying a
  file.path parameter, the request pattern associated with exploitation of the
  unauthenticated path traversal CVE-2026-85706.
references:

  - https://www.theregister.com/security/2026/09/14/perfect-10-gitlab-bug-under-attack-days-after-patch-lands/5296176
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85706
author: Adverse Trace
date: 2026/09/14
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_endpoint:
    cs-uri-stem|contains: '/api/v4/projects/'
  selection_endpoint_suffix:
    cs-uri-stem|endswith: '/repository/commits/'
  selection_param:
    cs-uri-query|contains: 'file.path'
  condition: selection_method and selection_endpoint and selection_endpoint_suffix and selection_param
fields:

  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:

  - Legitimate API clients posting commits that include a file.path parameter
level: high

Field-mapping caveat: cs-uri-stem / cs-uri-query follow common web-log schemas, but many proxies do not log POST bodies. Where the file.path parameter is carried in the request body rather than the query string, map selection_param to the body field your log pipeline exposes, or detect on the endpoint pair alone and triage the body separately. Tune against legitimate GitLab API traffic before alerting.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• The Register — Perfect-10 GitLab bug under attack days after patch lands — https://www.theregister.com/security/2026/09/14/perfect-10-gitlab-bug-under-attack-days-after-patch-lands/5296176 — 2026-09-14
• Rapid7 Blog — CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild — https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild — 2026-09-14
• The Hacker News — GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure — https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html
• CISA Known Exploited Vulnerabilities / NVD — CVE-2026-85706 — GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-85706
• SecurityWeek — GitLab Vulnerability Exploited One Day After Disclosure — https://www.securityweek.com/gitlab-vulnerability-exploited-one-day-after-disclosure/

8. Adverse Trace position

CVE-2026-85706 is a genuine emergency for any EMEA financial services firm running self-managed GitLab CE/EE with internet exposure: CVSS 10.0 CRITICAL, unauthenticated, single-request exploitation, CISA KEV-listed on 2026-09-11 with a CISA remediation due date of 2026-09-14 for FCEB agencies, and a fixed release available since 2026-09-10. The EPSS score of 11% is moderate rather than extreme, but KEV status is the stronger signal here and we weight it accordingly. Client impact is concentrated in confidentiality: arbitrary file read on a platform holding source code, configuration and credentials, with downstream risk to CI/CD pipelines and any secrets reachable from the host. Two caveats we will not paper over — the in-the-wild probe observation is single-sourced to watchTowr and should be verified before it drives enforcement, and no actor is named in any source, so attribution is unconfirmed. We will track further exploitation reporting, any vendor advisory updates, and any change to the KEV entry, and reissue if the picture shifts.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.