In gymnastics, a perfect 10 gets you a gold medal. In cybersecurity, a perfect 10 CVSS score means an unauthenticated stranger on the internet can read any file on your server with a single HTTP request. GitLab just scored the second kind, and the internet noticed within hours.
One Request, Every File, No Login Required
CVE-2026-85706 is a path traversal flaw in GitLab's repository commits API, affecting both Community and Enterprise Editions from 18.7 up through versions before 19.1.8, 19.2.6, and 19.3.2. The bug comes down to improper path confinement and missing authentication checks — meaning an attacker doesn't need credentials, just a public project on the target instance, to pull files like logs and configs that can contain credentials, secrets, and access tokens.
GitLab shipped patches on September 11, 2026. The watchTowr honeypot network clocked in-the-wild probing at 06:00 UTC that same day — attackers were testing the exploit before most admins had finished their morning coffee. CISA added it to its Known Exploited Vulnerabilities catalog immediately, giving federal agencies until September 14 to patch.
Why Your Git Server Is Suddenly Everyone's Problem
GitLab.com itself is patched, but there are more than 20,000 self-managed instances out there, and plenty of them are quietly running exposed to the internet with stale versions. A single leaked GitLab config can cascade into leaked deploy keys, CI/CD secrets, and access to every downstream system those secrets touch.
The part people miss: this isn't really a "GitLab problem," it's a supply chain problem wearing a GitLab costume. Your Git server holds the keys to your entire deployment pipeline, which makes it one of the highest-value single targets in your whole stack — and one of the most under-monitored.
A CVSS 10 with active exploitation and a three-day patch window isn't a "get to it next sprint" bug — it's a "stop what you're doing" bug.
If your team needs a sanity check on what else in your deployment pipeline could hand an attacker the keys to the kingdom, WTK's free developer security checklist walks through exactly this kind of supply-chain exposure — grab it here.
Source: The Hacker News