--- title: GitLab Vulnerability Under Active Exploitation Enables... description: CVE-2026-85706, a critical path-traversal vulnerability in self-managed GitLab CE/EE (CVSS 10.0), is under active exploitation and allows unauthenticated... canonical: https://daily.dev/posts/gitlab-vulnerability-under-active-exploitation-enables-unauthenticated-data-exfiltration-5hnex7c8x twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitLab Vulnerability Under Active Exploitation Enables Unauthenticated Data Exfiltration | daily.dev og:description: CVE-2026-85706, a critical path-traversal vulnerability in self-managed GitLab CE/EE (CVSS 10.0), is under active exploitation and allows unauthenticated... og:url: https://daily.dev/posts/gitlab-vulnerability-under-active-exploitation-enables-unauthenticated-data-exfiltration-5hnex7c8x og:image: https://api.daily.dev/og/posts/5HNeX7c8x.png og:image:alt: GitLab Vulnerability Under Active Exploitation Enables Unauthenticated Data Exfiltration og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitLab Vulnerability Under Active Exploitation Enables Unauthenticated Data Exfiltration **[InfoQ](https://daily.dev/sources/infoq)** · 3 min read · 0 upvotes · 0 comments ## Summary CVE-2026-85706, a critical path-traversal vulnerability in self-managed GitLab CE/EE (CVSS 10.0), is under active exploitation and allows unauthenticated attackers to read arbitrary files from the server, including CI/CD variables, runner tokens, deploy tokens, and SSH keys, as long as at least one public project exists. Attackers began probing within hours of disclosure, and CISA added it to its Known Exploited Vulnerabilities catalog. Affected versions span 18.7 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1; GitLab patched the issue in 19.3.2, 19.2.6, and 19.1.8, and later backported fixes to the end-of-life 19.0.9 and 18.11.12 releases. Security experts warn that patching alone does not revoke already-stolen credentials, urging teams to rotate deploy tokens, CI variables, and SSH keys and audit builds that ran during exposure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-85706 and which GitLab versions are affected? CVE-2026-85706 is a critical path-traversal vulnerability in self-managed GitLab CE/EE with a CVSS score of 10.0, allowing an unauthenticated attacker to read arbitrary files from the server due to improper path confinement and missing authentication in the repository commits API. It affects versions 18.7 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1, and requires only that the instance have at least one public project. _Teams running self-managed GitLab can track emerging CVEs like this one on daily.dev to patch before attackers strike._ ### How do I fix CVE-2026-85706 in self-managed GitLab? Upgrade self-managed GitLab CE/EE to version 19.3.2, 19.2.6, or 19.1.8 depending on the affected branch. GitLab also backported the fix to the end-of-life versions 19.0.9 and 18.11.12 two weeks after the initial patch, since some instances on those older releases remained exposed. _daily.dev helps engineers stay on top of patch releases so upgrade decisions for GitLab don't slip through the cracks._ ### Is patching enough after the GitLab CVE-2026-85706 path traversal exploit? No, patching only stops new file reads; it does not revoke deploy tokens, CI variables, or SSH keys that an attacker may have already copied through the exposed repository commits API. Security experts recommend rotating those credentials and auditing which packages or images builds pulled while the old credentials were still valid, along with restricting internet exposure of GitLab instances. _daily.dev surfaces expert incident-response advice like this for teams racing to contain a GitLab breach._ ## Similar posts on daily.dev - [Hackers now exploit critical Gitea flaw in code injection attacks](https://daily.dev/posts/hackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks-gmz4nkjzi) · BleepingComputer · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#gitlab](https://daily.dev/tags/gitlab) [View this post on daily.dev](https://daily.dev/posts/gitlab-vulnerability-under-active-exploitation-enables-unauthenticated-data-exfiltration-5hnex7c8x) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GitLab Vulnerability Under Active Exploitation Enables Unauthenticated Data Exfiltration","url":"https://daily.dev/posts/gitlab-vulnerability-under-active-exploitation-enables-unauthenticated-data-exfiltration-5hnex7c8x","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/gitlab-vulnerability-under-active-exploitation-enables-unauthenticated-data-exfiltration-5hnex7c8x"},"datePublished":"2026-10-03T16:02:50.545Z","dateModified":"2026-10-03T16:03:11.988Z","description":"CVE-2026-85706, a critical path-traversal vulnerability in self-managed GitLab CE/EE (CVSS 10.0), is under active exploitation and allows unauthenticated...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9e144759cac416e2a3a06a5d722d6ec1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9e144759cac416e2a3a06a5d722d6ec1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/gitlab-vulnerability-under-active-exploitation-enables-unauthenticated-data-exfiltration-5hnex7c8x","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cicd,gitlab","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"GitLab Vulnerability Under Active Exploitation Enables Unauthenticated Data Exfiltration"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/gitlab-vulnerability-under-active-exploitation-enables-unauthenticated-data-exfiltration-5hnex7c8x#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-85706 and which GitLab versions are affected?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-85706 is a critical path-traversal vulnerability in self-managed GitLab CE/EE with a CVSS score of 10.0, allowing an unauthenticated attacker to read arbitrary files from the server due to improper path confinement and missing authentication in the repository commits API. It affects versions 18.7 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1, and requires only that the instance have at least one public project. Teams running self-managed GitLab can track emerging CVEs like this one on daily.dev to patch before attackers strike."}},{"@type":"Question","name":"How do I fix CVE-2026-85706 in self-managed GitLab?","acceptedAnswer":{"@type":"Answer","text":"Upgrade self-managed GitLab CE/EE to version 19.3.2, 19.2.6, or 19.1.8 depending on the affected branch. GitLab also backported the fix to the end-of-life versions 19.0.9 and 18.11.12 two weeks after the initial patch, since some instances on those older releases remained exposed. daily.dev helps engineers stay on top of patch releases so upgrade decisions for GitLab don't slip through the cracks."}},{"@type":"Question","name":"Is patching enough after the GitLab CVE-2026-85706 path traversal exploit?","acceptedAnswer":{"@type":"Answer","text":"No, patching only stops new file reads; it does not revoke deploy tokens, CI variables, or SSH keys that an attacker may have already copied through the exposed repository commits API. Security experts recommend rotating those credentials and auditing which packages or images builds pulled while the old credentials were still valid, along with restricting internet exposure of GitLab instances. daily.dev surfaces expert incident-response advice like this for teams racing to contain a GitLab breach."}}]} ```