CISA Warns of Active Exploitation Targeting Critical GitLab Path Traversal Flaw

Active In-The-Wild Threat

Threat actors are actively attempting to exploit a maximum-severity security flaw in GitLab servers to extract sensitive corporate data and credentials. Tracked as CVE-2026-85706, the flaw stems from improper path confinement and missing authentication checks within the platform's repository commits API endpoint. Remote, unauthenticated attackers can leverage this issue to retrieve arbitrary files from affected host systems through a single crafted HTTP request.

The Cybersecurity and Infrastructure Security Agency (CISA) formally added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after threat intelligence researchers detected widespread internet probing aimed at identifying unpatched deployments. CISA has mandated that federal civilian agencies remediate the flaw under Binding Operational Directive (BOD) 26-04, while strongly advising private sector network defenders to apply patches promptly.

Mitigation and Detection Guidance

GitLab has released emergency security updates for GitLab Community Edition (CE) and Enterprise Edition (EE) across versions 19.3.2, 19.2.6, and 19.1. Administrators are advised to update their deployments immediately to block exploitation attempts.

To identify potential scanning or compromise attempts, security operations teams should audit system access logs for anomalous activity:

• Inspect web server logs for HTTP POST requests targeting the /api/v4/projects/{id}/repository/commits/ URI structure.
• Monitor for suspicious instances of the file.path parameter within API requests.
• Ensure both internet-facing and internal development instances are updated to supported build versions.

Given that software repositories frequently hold sensitive API keys and source code, unpatched developer infrastructure presents a high-value target for initial access and supply chain operations.