GitLab CVE-2026-85706: Unauthenticated File Read, Exploited

What to do

1. Check your version (Admin > Overview, or /help) and upgrade to 19.3.2, 19.2.6, 19.1.8, 19.0.9 or 18.11.12 or later.
2. If you cannot upgrade immediately, remove internet exposure of the instance until you can.
3. Search api_json.log for unauthenticated POSTs to repository commits or files APIs carrying a file.path parameter.
4. If an exposed instance ran a vulnerable version, rotate gitlab-secrets.json / secrets.yml material, database, object storage, SMTP and LDAP credentials, and CI/CD secrets.
5. Deploy GitLab's published LFI detections in your SIEM.

How to check if you are affected or compromised

• In api_json.log, look for POST /api/v4/projects/:id/repository/commits requests with no meta.user whose params include file.path pointing at host paths such as gitlab.yml, secrets.yml, database.yml or gitlab-secrets.json.
• Look for percent-encoded or trailing-slash variants of the commits and files API routes from unfamiliar IPs.
• Use GitLab's three published detections: LFI reading gitlab.yml, LFI via metadata.path, and LFI file path attempt.
• After a suspected read, watch for sessions or tokens you did not issue and unusual access to object storage or the database.

What happened#

On September 10, 2026 GitLab shipped a critical patch release (19.3.2, 19.2.6, 19.1.8) whose top fix is CVE-2026-85706. The bug is a path traversal in the repository commits API. GitLab's description: "an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement." GitLab scores it CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). A HackerOne researcher, s3ntago, reported it.

CISA added it to the KEV catalog on September 11, one day after the patch, with a federal due date of September 14. CISA's enrichment in the CVE record marks exploitation as active and the attack as automatable. On September 23 GitLab backported the fix to 19.0.9 and 18.11.12.

GitLab's security team published detection notes describing the mechanism. On multipart uploads, Workhorse passes Rails a file.path parameter. An attacker sends an empty file part with a file.path that points at a file on the server, so Rails reads that host file instead of uploaded bytes. The notes say the parameter is reached mainly through POST /api/v4/projects/:id/repository/commits and the repository files API. They add that "public exploits defeat route sanitization with a trailing-slash bypass and percent-encoding."

Who is affected#

Self-managed GitLab CE and EE from 18.7 onward is affected, covering every deployment type: Omnibus, source and Helm. Vulnerable ranges are 18.7 to before 18.11.12, 19.0 to before 19.0.9, 19.1 to before 19.1.8, 19.2 to before 19.2.6, and 19.3 to before 19.3.2. GitLab.com and GitLab Dedicated were already patched, so customers there have nothing to do.

Do you really need to act?#

Yes, if you run GitLab yourself on an affected version. This is about as bad as a "file read" gets:

• No authentication is needed. CISA rates it automatable and confirms exploitation.
• The prime targets are gitlab.yml, secrets.yml, database.yml and gitlab-secrets.json. GitLab's own detection notes say these hold the Rails secret key base and the encryption keys used for sessions, tokens, stored CI/CD variables and 2FA, plus database, object storage, SMTP and LDAP credentials. "A confirmed read is therefore a credential exposure, not merely an information disclosure."
• With the secret key base, an attacker can forge sessions and decrypt CI/CD variables. That reaches your cloud accounts and deployment pipelines.

Instances only reachable on a private network carry less risk but should still be patched promptly. Versions before 18.7 are not in the affected range.

What to do now#

1. Check the version (sudo gitlab-rake gitlab:env:info on Omnibus, or the Help page) and upgrade to 19.3.2, 19.2.6, 19.1.8, 19.0.9 or 18.11.12 or later (sudo apt-get install gitlab-ee=<version> or your Helm chart bump).
2. If you can't upgrade today, take the instance off the internet until you can.
3. Hunt in api_json.log as described below.
4. If an internet-exposed instance ran a vulnerable version after September 10, plan for secret rotation: regenerate secrets in gitlab-secrets.json following GitLab's procedures, rotate database, object-storage, SMTP and LDAP credentials, rotate CI/CD variables that hold cloud or deploy keys, and invalidate active sessions and tokens.

How to tell if you were hit#

GitLab's detections look in api_json.log for unauthenticated requests (an ip/<addr> client with no meta.user) to the commits or files APIs whose params contain an empty file part and a file.path pointing at config or secret files. GitLab published three rules: "GitLab LFI attempt reading gitlab.yml", "GitLab LFI via metadata.path parameter" and "GitLab LFI file path attempt". Widen your search to other host paths such as /etc/passwd, /proc/self/, SSH keys and .env files. Rejected attempts (status 400) are still worth logging. A successful response to such a request means you should rotate secrets. Afterwards, watch for unfamiliar sessions, new personal access tokens and odd access to object storage or the database.

Timeline#

• Sep 10, 2026 — GitLab releases 19.3.2, 19.2.6 and 19.1.8 with the fix.
• Sep 11, 2026 — CISA adds CVE-2026-85706 to KEV, with a federal due date of Sep 14.
• Sep 12, 2026 — The CVE record is published (NVD).
• Sep 23, 2026 — GitLab backports the fix to 19.0.9 and 18.11.12.

Vulnerability records

• CVE-2026-85706 · KEV 2026-09-11 · GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. GitLab — GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8 docs.gitlab.com
2. CVE.org — CVE-2026-85706 cve.org
3. NVD — CVE-2026-85706 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-85706) cisa.gov
5. GitLab Security — Detection: GitLab LFI attempt reading gitlab.yml gitlab.com