{"id":2019,"date":"2026-09-15T07:20:00","date_gmt":"2026-09-15T00:20:00","guid":{"rendered":"https:\/\/vncybers.vn\/canh-bao-gitlab-cve-2026-85706-lo-hong-cvss-10-bi-khai-thac\/"},"modified":"2026-09-15T07:20:00","modified_gmt":"2026-09-15T00:20:00","slug":"gitlab-cve-2026-85706-cvss-10-flaw-exploited-sensitive-file-read-2","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/canh-bao-gitlab-cve-2026-85706-lo-hong-cvss-10-bi-khai-thac\/","title":{"rendered":"GitLab Warning CVE-2026-85706: CVSS 10 Vulnerability Exploited to Read Sensitive File"},"content":{"rendered":"

CVE-2026-85706<\/strong>A CVSS 10.0 path traversal vulnerability in GitLab Community Edition and Enterprise Edition has been added by CISA to the Known Exploited Vulnerabilities (KEV) catalog. Unpatched self-managed GitLab servers may allow unauthenticated attackers to read arbitrary files, exposing credentials, secrets, and configuration data.<\/p>\n

\"C\u1ea3nh<\/p>\n

Self-managed GitLab instances are being targeted by internet scanning and exploitation. Image: The Hacker News<\/em><\/p>\n

Where is the gap?<\/h2>\n

According to GitLab, the issue is caused by improper path confinement combined with missing authentication enforcement in the repository commits API. When at least one public project exists, a specially crafted HTTP request may escape the intended file scope and read server content.<\/p>\n

Affected versions include GitLab CE and EE from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. GitLab released versions 19.1.8, 19.2.6, and 19.3.2 to address the flaw; administrators should upgrade to the appropriate patched or newer release.<\/p>\n

From Disclosure to Active Exploitation<\/h2>\n

GitLab disclosed the patch on September 10, 2026. Within hours, watchTowr observed internet probes beginning at around 06:00 UTC on September 11. CISA then confirmed active exploitation and added CVE-2026-85706 to KEV, requiring U.S. federal civilian agencies to remediate it by September 14, 2026.<\/p>\n

Subsequent observations showed activity progressing from behavioral probing to identifying vulnerable systems, successful exploitation, and configuration-file exfiltration. Some actors were seen searching GitLab configuration secrets and host SSH information.<\/p>\n

Why Is the Risk Especially Severe?<\/h2>\n

GitLab commonly stores source code, CI\/CD variables, access tokens, deployment keys, and production connection details. Reading sensitive files may lead not only to data exposure but also account takeover, host access, pipeline modification, or poisoning of software distributed through the supply chain.<\/p>\n

The CVSS 10.0 score reflects a dangerous combination: remote exploitation, no account required, and potentially extensive impact. Internet-facing self-managed instances require the highest priority; GitLab.com is managed by the provider and does not require customers to update servers themselves.<\/p>\n

Recommendations for Administrators<\/h2>\n
    \n
  • Upgrade immediately to GitLab 19.3.2, 19.2.6, 19.1.8, or a newer release appropriate for the installed branch.<\/li>\n
  • If immediate patching is impossible, restrict internet access to GitLab and disable public projects unless genuinely required.<\/li>\n
  • Review logs for HTTP POST requests to \/api\/v4\/projects\/{id}\/repository\/commits\/<\/code> containing parameters related to file.path<\/code>.<\/li>\n
  • Rotate tokens, SSH keys, passwords, and CI\/CD secrets if there are signs of file reading or unauthorized access.<\/li>\n
  • Review pipeline history, runners, and source-code changes for persistence or supply-chain poisoning activity.<\/li>\n<\/ul>\n

    Lessons for organizations<\/h2>\n

    The speed from disclosure to scanning and exploitation shows that the patch window for internet-facing DevOps platforms is shrinking. Organizations need version inventories, KEV alerts, emergency patch procedures, and rapid secret rotation. Separating GitLab from production systems and minimizing token privileges can also reduce impact when one defensive layer fails.<\/p>\n

    VNCyberS<\/strong> compiled from GitLab, CISA, BleepingComputer, The Hacker News, and watchTowr<\/em><\/p>","protected":false},"excerpt":{"rendered":"

    CVE-2026-85706, m\u1ed9t l\u1ed7 h\u1ed5ng path traversal \u0111\u1ea1t \u0111i\u1ec3m CVSS 10.0 trong GitLab Community Edition v\u00e0 Enterprise Edition, \u0111\u00e3 \u0111\u01b0\u1ee3c CISA \u0111\u01b0a v\u00e0o danh m\u1ee5c Known Exploited Vulnerabilities (KEV). C\u00e1c m\u00e1y ch\u1ee7 GitLab t\u1ef1 qu\u1ea3n tr\u1ecb ch\u01b0a v\u00e1 c\u00f3 th\u1ec3 b\u1ecb k\u1ebb t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n x\u00e1c th\u1ef1c \u0111\u1ecdc t\u1ec7p t\u00f9y \u00fd, t\u1eeb \u0111\u00f3 l\u00e0m l\u1ed9 […]<\/p>\n","protected":false},"author":2,"featured_media":2018,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[566,754,167,807,806,810,811,812,809,808,438],"class_list":["post-2019","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-chuoi-cung-ung-phan-mem","tag-ci-cd","tag-cisa-kev","tag-cve-2026-85706","tag-gitlab","tag-gitlab-ce","tag-gitlab-ee","tag-khai-thac-lo-hong","tag-lo-hong-cvss-10","tag-path-traversal","tag-watchtowr"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2019","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2019"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2019\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2018"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2019"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2019"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2019"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}