CVE-2026-85706
Sfruttamento noto · CISA KEV
CVSS 10 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6…
Data di correzione federale CISA 14 set · data superata
Vulnerabilità · 35 giorni fa
CISA ha messo CVE-2026-85706 nel catalogo KEV e le segnalazioni di sfruttamento in-the-wild hanno spostato GitLab self-managed fuori dal normale ciclo di patch. Per chi gestisce GitLab CE o EE in proprio, la finestra di risposta si è stretta a un’emergenza.
La falla nel repository commits API permette a un utente non autenticato di forzare GitLab a restituire file arbitrari dal server. In pratica, possono uscire repository file, config, token e altri segreti che l’applicazione tratta come dati interni; la correzione in 19.1.8, 19.2.6 e 19.3.2 non annulla ciò che è già stato letto.
Il punto ora non è solo chiudere CVE-2026-85706, ma assumere che un’istanza esposta possa aver perso materiale sensibile prima della patch. Questo vale per Omnibus, source e Helm chart, perché l’esposizione riguarda la base di fiducia della piattaforma di sviluppo, non un singolo progetto.
Sfruttamento noto · CISA KEV
CVSS 10 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6…
Data di correzione federale CISA 14 set · data superata
16 fonti che coprono questa storia
Metasploit Wrap-Up Belgian Waffles Chocolates and Modules Frites
Rapid7 Website
GitLab Path Traversal Vulnerability | Outbreak Alert | FortiGuard Labs
FortiGuard Labs has observed attack activity targeting CVE-2026-85706, a critical path traversal vulnerability in GitLab Community Edition and Ente...
FortiGuard Labs Threat Signals
Threat Signal Report | FortiGuard Labs
What is the Vulnerability?FortiGuard Labs has observed attack activity targeting CVE-2026-85706, a critical path traversal vulnerability in GitLab ...
A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove
The vulnerability impacts self-managed CE and EE instances and provides an unauthenticated path to arbitrary file reads. It’s already being probed in the wild.
Maximum Severity GitLab Flaw Puts Supply Chains at Risk
CVE-2026-85706 is a path traversal vulnerability with a 10 out of 10 CVSS score, affecting both GitLab Community Edition and Enterprise Edition instances.
Perfect-10 GitLab bug under attack days after patch lands
CISA confirms active exploitation as watchTowr spots miscreants probing internet-facing servers
Malicious actors already using critical GitLab flaw, CISA and others warn
The vulnerability could let unauthenticated users access sensitive files from software-development environments.
CVE-2026-85706 Critical Gitlab Path Traversal Exploited in the Wild
GitLab has patched CVE-2026-85706, a CVSSv3.1 10.0 path traversal vulnerability in the repository commits API that allows an unauthenticated user to read arbitrary files from GitLab CE and EE servers.
Hackers Exploit Maximum Severity Flaw in GitLabs
CISA warns that threat actors are exploiting a vulnerability with a CVSS score of 10.0
GitLab ha publicado 1 vulnerabilidad de severidad crítica que, en caso de ser explotada, podría permit
CISA: Hackers now exploit max severity GitLab flaw in attacks
Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are now exploiting a maximum-severity GitLab vulnerability in attacks.
Kwetsbaarheid verholpen in GitLab Community en Enterprise Editions
GitLab heeft een kwetsbaarheid verholpen in GitLab Community en Enterprise Editions.
Part of the PlainSec briefing for 2026-09-28