GitLab CE/EE: critical path traversal CVE-2026-85706 exploited

📌 Later developments: GitLab CVE-2026-110264: LDAP injection and request smuggling too (October 22, 2026) · GitLab 19.5.1: new unauthenticated RCE, CVE-2026-110264 (October 22, 2026) · GitLab CVE-2026-97229: Rapid7 reproduces RCE, 19.3 fix is 19.3.5 (October 12, 2026) · GitLab 19.4.2: critical RCE CVE-2026-97229 in CI/CD regex (October 12, 2026)

On 11 September 2026 CISA added CVE-2026-85706, a path traversal vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE), to its Known Exploited Vulnerabilities (KEV) catalog: it is therefore already being exploited in real attacks. GitLab has released security updates that fix this and other vulnerabilities. According to the CERT-SE advisory, two of them are critical: CVE-2026-85706, with a CVSS score of 10.0, and CVE-2026-87719, with a CVSS score of 9.9.

On 6 October CERT-SE updated its advisory with the detection guidance published by GitLab. On 8 October the German BSI/CERT-Bund updated its advisory WID-SEC-2026-1010 on the GitLab CE/EE vulnerabilities, rated high severity.

What happened

CVE-2026-85706 is a path traversal flaw. According to CERT-SE, an unauthenticated attacker who exploits it can read arbitrary files from the GitLab server. No credentials are needed: the instance only has to be reachable. CISA’s KEV catalog lists vulnerabilities with evidence of exploitation.

CVE-2026-87719 affects only the Enterprise Edition and requires access. According to CERT-SE, an authenticated user with access to Duo Chat can reach configurations and sensitive data.

Technical details

• CVE-2026-85706: CVSS 10.0, path traversal in GitLab CE and EE; arbitrary file read from the server without authentication.
• Affected versions (CVE-2026-85706): all versions from 18.7 before 19.1.8, 19.2 before 19.2.6 and 19.3 before 19.3.2.
• CVE-2026-87719: CVSS 9.9, GitLab EE only; requires an authenticated user with access to Duo Chat, who can obtain configurations and sensitive data.
• Affected versions (CVE-2026-87719): GitLab EE, all versions from 18.3 before 19.1.8, 19.2 before 19.2.6 and 19.3 before 19.3.2.
• Fixed versions: 19.1.8, 19.2.6 and 19.3.2, released by GitLab with patch release 19.3.2.
• Exploitation: confirmed by CISA for CVE-2026-85706. According to CISA, use in ransomware campaigns is currently unknown; the deadline for US federal agencies was 14 September. The sources do not report exploitation of CVE-2026-87719.
• MITRE ATT&CK: exploiting an exposed service without authentication maps to T1190 (Exploit Public-Facing Application).

Indicators and detection

In its 6 October update, CERT-SE points to the additional information published by GitLab:

• detection rules for local file inclusion attempts: reading the gitlab.yml configuration file, access to the metadata path and path enumeration;
• a support article explaining how to check whether a file was actually exfiltrated via CVE-2026-85706, using the bytes written by GitLab’s Workhorse component.

For indicators, CERT-SE also refers to the technical analysis published by watchTowr.

A separate advisory: GitLab AI Gateway

On 5 October CERT-FR published advisory CERTFR-2026-AVI-1262 on a different vulnerability, CVE-2026-90970, affecting GitLab AI Gateway. CERT-FR lists remote arbitrary code execution as the risk and refers to GitLab’s 2 October bulletin for the fixes. Affected versions according to CERT-FR:

• AI Gateway 19.3.x before 19.3.2;
• AI Gateway 19.4.x before 19.4.1;
• AI Gateway from 18.1.6 and before 19.2.4.

The advisory does not describe the attack vector or the conditions for exploitation.

Impact for European and Italian companies

A GitLab server usually holds source code, pipeline configurations and credentials for integrations. A vulnerability that allows its files to be read without authentication, and that is already exploited, should be treated as urgent, especially if the instance is exposed to the Internet, as CERT-SE stresses.

For entities in scope of NIS2, vulnerability handling and the security of the software supply chain are part of the required measures. Unauthorised reading of files containing data or credentials is an incident to be assessed for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN.

What to do now

1. Inventory: identify all GitLab instances, with edition (CE or EE) and version, and check which ones are reachable from the Internet.
2. Update: bring every instance to 19.1.8, 19.2.6 or 19.3.2, or later, starting with the exposed ones. CISA asks to apply the mitigations provided by the vendor or, if none are available, to stop using the product.
3. Analyse the logs: CERT-SE recommends reviewing them to identify any intrusions. Use GitLab’s detection rules and, for every attempt you find, check with the support article whether the file was actually exfiltrated.
4. If you find an exfiltration: consider the data and credentials contained in the files read as exposed, replace the secrets and assess the notification obligations that apply to your organisation.
5. AI Gateway: if you use it, check GitLab’s 2 October bulletin and update it to a fixed version.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet, which products are recognised on them and which have known vulnerabilities: it helps you find out whether a GitLab instance is reachable from outside. ARX Shield lists the open vulnerabilities on monitored machines and highlights those already exploited by attackers. ARX Sentry collects logs and events from the servers where the agent is installed and checks file integrity in the chosen folders. With ARX Horizon you can look up vulnerability details and search for indicators of compromise from the portal.

Last updated: 8 October 2026