Important security updates for the source code management platform GitLab were released at the end of last week. Germany's Federal Office for Information Security, the BSI, has since issued a warning, since at least one of the fixed vulnerabilities is already being actively exploited.
The targeted flaw is CVE-2026-85706, which reaches the maximum possible CVSS score of 10.0 and therefore counts as critical. Under certain circumstances that GitLab has not detailed further, attackers can read arbitrary files from GitLab servers. No prior authentication is required, a single HTTP request to a vulnerable instance is enough. The cause is a combination of insufficient path restriction, known as path traversal, and a missing authentication check in GitLab's repository commits API.
Security researchers observe first attacks
Researchers at Watchtowr observed initial exploitation attempts as early as last weekend and warn that attackers can use the flaw to obtain configuration and login data, along with other confidential information that can enable further attacks. Both the Community Edition and Enterprise Edition of GitLab are affected, in versions 18.7 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1. Patches are available in versions 19.1.8, 19.2.6, and 19.3.2. GitLab.com and the GitLab Dedicated SaaS offering are already protected, according to the operator.
18 flaws fixed in total
Besides the actively exploited flaw, the updates also fix 17 other security vulnerabilities, including CVE-2026-87719, which is likewise rated critical and lets an authenticated attacker exfiltrate configuration and access data through a combination of the Advanced Search feature and Duo Chat. Six more flaws are rated high severity, nine medium, and one low, for 18 vulnerabilities addressed in total. Admins should update their instances promptly or take them offline as a precaution, then look for signs of possible compromise, since the BSI has published specific recommendations for this. According to a later update from Cert-Bund, around 3,150 internet-facing GitLab instances in Germany alone are vulnerable to CVE-2026-85706, and another 1,640 instances are additionally exposed through CVE-2026-19478, a flaw that has already been actively exploited since August.