Vulnerabilities & Exploits · Web App Attack

GitLab flaw hits KEV under active exploitation

CISA and multiple security reports now say CVE-2026-85706 in GitLab Community Edition and Enterprise Edition is being exploited in the wild, and CISA has added it to the Known Exploited Vulnerabilities catalog. GitLab fixed the issue in 19.1.8, 19.2.6, and 19.3.2, but the new listing turns this from a routine patch item into an emergency for self-managed instances.

The bug is in GitLab’s repository commits API: a crafted request can bypass the normal login check and make the server return files it should not expose. That can spill repository-stored secrets, tokens, logs, and configuration, so the fix stops new reads but does not undo anything already taken from disk.

For teams running GitLab as trusted development infrastructure, the remaining exposure is not just the app version but what may already have been read from the file layer. If GitLab sits beside code, credentials, or deployment material, the post-patch question is whether attackers also got the data that was supposed to stay inside the server.

16 sources · Sep 25

CVE-2026-85706

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6…

CISA federal remediation date Sep 14 · date passed

Timeline

Sources

Part of the PlainSec briefing for 2026-09-22

Every edition of this story: GitLab flaw hits KEV under active exploitation

More from today