You know that feeling when you fix a leaky faucet and someone's already mopping up water in the basement? That's GitLab this week. A maximum-severity flaw got patched, and attackers were probing for unpatched servers before most admins even finished reading the changelog.
A 10.0 Bug, Exploited Almost Instantly
CVE-2026-85706 is a path traversal vulnerability in GitLab's repository commits API, carrying a perfect CVSS score of 10.0. It stems from missing authentication checks and improper path confinement, meaning an attacker needs no account, no login, and no user interaction — just a single crafted HTTP request to read arbitrary files, including credentials and secrets, off a vulnerable server.
The flaw hits self-managed GitLab CE and EE instances running versions 18.7 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1. Security firm watchTowr reported in-the-wild probing for unpatched servers within roughly a day of the fix going public, and CISA added the bug to its Known Exploited Vulnerabilities catalog on September 11, giving federal agencies a hard three-day deadline to patch.
Why "We'll Patch It Next Sprint" Doesn't Cut It Anymore
This is the pattern that should worry every dev team, not just federal agencies: the gap between "vulnerability disclosed" and "actively exploited in the wild" keeps shrinking toward zero. GitLab isn't some obscure side tool either — it's the source-code backbone for a huge swath of the software industry, which makes a bug like this a supply-chain risk, not just an IT nuisance.
The part that's easy to miss is that this wasn't a sophisticated zero-day requiring nation-state resources. It's a path traversal bug — one of the oldest, most well-understood vulnerability classes in the book — and it still slipped through to production. That should be a bigger wake-up call than the CVSS score alone.
If your GitLab instance is self-managed and you haven't upgraded to 19.1.8, 19.2.6, or 19.3.2 yet, today is genuinely not the day to procrastinate on that ticket.
Patch cadence and supply-chain hygiene are exactly the kind of thing that quietly sink businesses — grab our free guide on defending against these attacks before your dev stack becomes the next headline: Developer's Security Checklist.
Source: BleepingComputer