---
title: "Security digest: September 10, 2026"
url: https://erroneo.us/security/2026-09-10/
description: "September 10, 2026 vulnerability digest: 1 brief (GitLab CVE-2026-85706: Unauthenticated File…); 2 CISA KEV additions (MikroTik); 4 critical advisories (Go…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-09-10
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: September 10, 2026

1 editorial brief, 2 known exploited (cisa kev) additions and 4 critical advisories.

## Take stock

- Act now: GitLab CVE-2026-85706: Unauthenticated File Read, Exploited . Administrators of self-managed GitLab CE/EE 18.7 and later (Omnibus, source, Helm), above all instances reachable from the internet.
- Do you run any of these? MikroTik RouterOS. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-13.
- Go: 3 critical advisories ( github.com/rclone/rclone , github.com/traefik/traefik/v3 , github.com/traefik/traefik/v2 ). Check with govulncheck ./... .
- npm: 1 critical advisory ( omniroute ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [GitLab CVE-2026-85706: Unauthenticated File Read, Exploited](https://erroneo.us/security/briefs/gitlab-commits-api-file-read-cve-2026-85706/index.md): Any unpatched self-managed GitLab 18.7 or later can have its configuration and secret keys read by anyone on the network, and CISA says it is being exploited; upgrade today and rotate secrets if you were exposed.

## Known exploited (CISA KEV)

- [CVE-2026-86060](https://erroneo.us/security/cve/CVE-2026-86060/index.md) MikroTik RouterOS: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability (CISA due 2026-09-13)
- [CVE-2026-67277](https://erroneo.us/security/cve/CVE-2026-67277/index.md) MikroTik RouterOS: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability (CISA due 2026-09-13)

## Critical advisories

- [CVE-2026-88018](https://erroneo.us/security/cve/CVE-2026-88018/index.md) rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass — Go github.com/rclone/rclone < 1.75.1 → 1.75.1
- [CVE-2026-88007](https://erroneo.us/security/cve/CVE-2026-88007/index.md) Traefik HTTP/3 Backend NTLM Connection Reuse — Go github.com/traefik/traefik/v3 >= 3.0.0, < 3.7.13 → 3.7.13; Go github.com/traefik/traefik/v2 >= 2.11.0, < 2.11.57 → 2.11.57
- [CVE-2026-88044](https://erroneo.us/security/cve/CVE-2026-88044/index.md) rclone: RC per-server auth-proxy bypass — Go github.com/rclone/rclone >= 1.70.0, < 1.75.1 → 1.75.1
- [CVE-2026-88062](https://erroneo.us/security/cve/CVE-2026-88062/index.md) OmniRoute ACP Custom-Agent Remote Code Execution (RCE) — npm omniroute <= 3.8.50 → no fix

---
Source page: https://erroneo.us/security/2026-09-10/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt