Overview
- GitLab released emergency fixes on Thursday for two critical flaws, CVE-2026-85706 and CVE-2026-87719, and urged all self-managed installations to upgrade immediately to versions 19.3.2, 19.2.6, or 19.1.8.
- CVE-2026-85706 is a maximum-severity path traversal bug in the repository commits API that fails to confine file paths and does not require authentication to read arbitrary files from the server.
- Security firms led by WatchTowr reported active internet-wide probes and the first exploitation attempts within hours to a day after the public disclosure, and they warn broad automated attacks are likely to follow.
- Defenders should install the patched releases at once or restrict public access to self-hosted instances and hunt logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ that contain file.path parameters as indicators of attempted exploitation.
- The flaws carry extreme severity scores and matter widely because GitLab hosts source code and CI pipelines for many projects, so exposed instances can leak code, credentials, and pipeline secrets and may enable downstream supply-chain attacks.