The Cybersecurity and Infrastructure Security Agency has placed a critical GitLab security flaw on its Known Exploited Vulnerabilities list, mandating federal agencies and private entities act within three days. The vulnerability, assigned CVE-2026-85706, carries a perfect 10/10 severity score and enables attackers to access sensitive files through path traversal techniques.
GitLab disclosed the flaw on September 12, 2026, revealing it affects all versions prior to 17.8.1. The path traversal issue allows malicious actors to read arbitrary files from the server by manipulating file paths in API requests. This could expose configuration files, credentials, and other sensitive data stored within GitLab instances. The vulnerability exists in the GitLab Shell component, which handles file operations and repository access.
Security researchers observed threat actors developing exploit tools within hours of the disclosure. The attack vector requires only basic API access to a vulnerable GitLab instance, making it accessible to a wide range of malicious actors. CISA's decision to add this flaw to the KEV catalog reflects urgent concerns about active exploitation in the wild. The agency typically provides 90 days for remediation, but this case received immediate action due to evidence of real-world attacks.
Path traversal vulnerabilities allow attackers to escape intended directories and access files elsewhere on the system. Unlike remote code execution flaws, this issue doesn't directly execute malicious code but exposes sensitive information that could enable further attacks. The 2023 GitLab vulnerability (CVE-2023-3657) required similar remediation urgency, with CISA issuing emergency directives to federal agencies.
Organizations should upgrade to GitLab version 17.8.1 or later immediately. Administrators should review access logs for suspicious file access patterns and rotate any credentials that may have been exposed. The vulnerability affects both self-hosted GitLab instances and GitLab SaaS offerings, though the latter receive automatic updates. Security teams should verify patches have been applied successfully and monitor for indicators of compromise. Failure to remediate could result in data breaches, unauthorized system access, and potential compliance violations under various cybersecurity frameworks.
What is the CVE number for this GitLab vulnerability? The flaw is tracked as CVE-2026-85706 and represents a critical path traversal issue in GitLab versions prior to 17.8.1.
How quickly must organizations patch this vulnerability? Federal agencies have three days to remediate, while private businesses should act immediately given evidence of active exploitation by threat actors.
Can this vulnerability be exploited remotely? Yes, attackers can exploit CVE-2026-85706 through basic API access to vulnerable GitLab instances without requiring authentication in some configurations.