The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting a maximum-severity vulnerability affecting self-managed GitLab servers. The flaw, tracked as CVE-2026-85706, can allow unauthenticated attackers to access sensitive files containing credentials, secrets and other valuable information.
The vulnerability stems from missing authentication enforcement and improper path confinement in GitLab’s repository commits API. Under certain conditions, attackers can exploit the weakness remotely to read arbitrary files from a vulnerable server without first authenticating.
The impact can be particularly serious because GitLab servers frequently contain source code, deployment configurations, API tokens and credentials used by development and CI/CD environments. Access to these secrets could potentially allow attackers to expand an intrusion into cloud services, production infrastructure or other internal systems.
GitLab patched CVE-2026-85706 in Community Edition and Enterprise Edition versions 19.3.2, 19.2.6 and 19.1. The company urged administrators of self-managed installations to upgrade immediately, while GitLab.com is already running patched software and GitLab Dedicated customers do not need to take action.
Shortly after the vulnerability was disclosed, cybersecurity company watchTowr observed attackers scanning the internet for vulnerable GitLab installations. Researchers warned that the flaw can be used to retrieve arbitrary files through a single HTTP request, making exploitation relatively straightforward once an exposed server is identified.
CISA subsequently added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog, confirming that exploitation has moved beyond scanning and into real attacks. Under Binding Operational Directive 26-04, U.S. federal agencies were given only three days to secure affected systems.
Although the directive applies specifically to federal agencies, CISA is encouraging private-sector organizations to prioritize the vulnerability as well. GitLab’s platform has more than 30 million registered users and is used by more than half of Fortune 100 companies, increasing the potential value of vulnerable installations to attackers.
Administrators should also investigate whether exploitation occurred before patching. watchTowr recommends examining logs for suspicious HTTP POST requests targeting/api/v4/projects/{id}/repository/commits/endpoints and containingfile.pathparameters.
CVE-2026-85706 is not the first GitLab vulnerability to attract real-world exploitation. Since November 2021, CISA has identified four GitLab vulnerabilities as actively exploited, including two older flaws that were added to the agency’s catalog earlier this year.
For organizations operating self-managed GitLab infrastructure, patching should now be treated as an urgent security action rather than routine maintenance. Because the vulnerability can expose credentials and other secrets without authentication, potentially compromised servers should also be reviewed for suspicious access and exposed credentials should be rotated when necessary.