GitLab File‑Read Flaw Triggers Rapid Exploitation After Patch

GitLab released patches for several security issues, including a maximum‑severity path traversal vulnerability identified as CVE‑2026‑85706. The flaw has a CVSS score of 10.0 and targets the repository commits API, allowing an unauthenticated user to read arbitrary files on the GitLab server ¹.

The vulnerability works by manipulating commit messages so that a specially crafted URL can be constructed to traverse directories outside the intended scope. This bypasses authentication checks and exposes sensitive data such as configuration files or private keys stored on the server ¹.

Experts note that the attack surface is similar in concept—though not identical—to earlier high‑profile flaws like the Jenkins backdoor discovered earlier this year. Both vulnerabilities stem from insufficient validation of user data during API processing stages where system resources are mixed freely without proper sanitization before access decisions are made.

Rapid exploitation attempts followed the patch release, with probes appearing within hours of public disclosure. Threat actors were already aware of potential weaknesses in older GitLab versions through bug bounty programs or independent research channels and had prepared automated reconnaissance scans targeting vulnerable deployments ¹.

Security teams should immediately verify whether their installations fall within known vulnerable version ranges. Detecting subtle file‑access anomalies requires dedicated monitoring tools capable of flagging unauthorized reads across container orchestration platforms such as Kubernetes, which many organizations now deploy globally.

Affected organizations must prioritize applying the latest GitLab updates, audit repository commit APIs for proper input sanitization, and enforce strict authentication controls to prevent unauthenticated access. Failure to act promptly could expose critical internal files to attackers with minimal effort, compromising both privacy and operational integrity.