Emergency Patches Released for GitLab Vulnerabilities
GitLab issued emergency patches on Thursday for two severe security vulnerabilities within its software development platform. One of these flaws holds a CVSS score of 10.0, the highest possible industry rating for risk. The company confirmed that its own hosted service versions are secure, but operators managing their own installations must apply the updates immediately to prevent unauthorized access.
The most dangerous issue, tracked as CVE-2026-85706, resides in the repository commit interface. This path traversal bug allows an attacker to read arbitrary files from a server without needing valid credentials or an existing account. The flaw impacts every version from 18.7 through 19.1.8, as well as the 19.2 and 19.3 releases prior to the most recent update.
Threat Actors Begin Scanning for Exploits
Security firm WatchTowr Labs reported that it is already detecting internet-wide probes searching for affected servers. Attackers can trigger the path traversal vulnerability with a single, specially crafted HTTP request. The firm warns that self-hosted GitLab servers reachable from the public internet face the highest risk of compromise.
Defenders should monitor server logs for POST requests sent to paths under /api/v4/projects/{id}/repository/commits/ that contain a file.path parameter. This pattern matches historical trends where indiscriminate scanning often follows the public disclosure of critical software vulnerabilities. The Cybersecurity and Infrastructure Security Agency added these flaws to its Known Exploited Vulnerabilities list on Friday afternoon, reflecting the urgency of the situation.
Impact on Enterprise Editions and Secondary Vulnerabilities
A second vulnerability, CVE-2026-87719, impacts GitLab’s Enterprise Edition software. This flaw allows an authenticated user with access to Duo Chat to hide commands within standard requests. Doing so forces the server to return internal configuration settings and passwords stored for the Advanced Search feature. It carries a CVSS score of 9.9 and affects versions 18.3 and newer.
GitLab’s rapid response mirrors a broader industry pattern where development platforms have become high-value targets for espionage and data theft. Similar vulnerabilities in other platforms have historically led to the loss of proprietary source code or credentials that grant deeper network access. Organizations relying on self-managed infrastructure must prioritize these patches to avoid becoming the next target for automated exploitation campaigns.