CISA flags critical GitLab path traversal flaw as attackers probe for vulnerable instances

A critical vulnerability in GitLab's DevSecOps platform is now under active attack, according to a warning from the U.S. Cybersecurity and Infrastructure Security Agency. The flaw affects a platform deployed across more than half of Fortune 100 companies and serves approximately 30 million registered users globally.

Tracked as CVE-2026-85706, the vulnerability stems from missing authentication enforcement and improper path confinement in the repository commits API. Unauthenticated attackers can leverage this flaw to extract credentials, secrets, and other sensitive data from affected servers.

GitLab released patches for Community Edition and Enterprise Edition in versions 19.3.2, 19.2.6, and 19.1 on Thursday, urging immediate deployment. Security researchers at watchTowr detected attackers scanning the internet for unpatched GitLab installations within a day of the fix becoming available.

watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab Path Traversal vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request

watchTowr

The security firm cautioned that widespread exploitation could follow quickly based on patterns from previous GitLab incidents. Defenders should examine log files for HTTP POST requests targeting /api/v4/projects/{id}/repository/commits/ URIs that include file.path parameters to detect potential compromise attempts.

CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day watchTowr published its findings. Under Binding Operational Directive 26-04, federal agencies now have three days to remediate the vulnerability.

While the directive applies only to federal civilian, executive and defense agencies, CISA extended its recommendation to all organizations. According to the agency, "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities."

This marks the fourth GitLab vulnerability that CISA has designated as actively exploited since November 2021. Earlier this year in February, two additional flaws—CVE-2021-22175 and CVE-2021-39935—were added to the list. In January, GitLab also released a patch for a high-severity two-factor authentication bypass vulnerability that could allow attackers with knowledge of a target's account ID to circumvent the second authentication factor.