GitLab CVE-2026-85706: Unauthenticated Arbitrary File Read (CVSS 10), Scanned Within Hours

> TL;DR: CVE-2026-85706 (CVSS 10.0) is a path traversal in GitLab CE/EE's repository commits API, combined with missing authentication enforcement, allowing an unauthenticated user to read arbitrary files from the server — under a single condition: at least one public project exists. GitLab cites "improper path confinement and missing authentication enforcement" in that API. watchTowr observed active probes from 06:00 UTC on September 11, 2026, targeting logs and configuration files to extract credentials and secrets. CISA added the flaw to KEV on September 11 with a September 14 deadline. Fixed versions are 19.1.8, 19.2.6, and 19.3.2, which also fix a critical EE deserialization flaw (CVE-2026-87719, CVSS 9.9).

What the flaw really enables

A file read looks less spectacular than code execution — a classic misjudgment. On a GitLab server, readable files include the instance configuration (application secrets, database keys, integration tokens) and logs containing credential fragments, session identifiers, and internal addresses. An attacker who reads GitLab's configuration often gets pivoting material: database, container registry, CI integrations, and sometimes pipeline secrets directly.

The "at least one public project" requirement is a symbolic barrier: most exposed self-hosted instances have one (docs, mirror, open-source project). And this is the second critical GitLab flaw in weeks, after the GraphQL injection CVE-2026-19478 — covered here in August — exploited almost immediately after disclosure. watchTowr sums up the attacker logic: GitLab concentrates source code, CI/CD secrets, and the ability to poison build pipelines — everything downstream becomes reachable.

Detection: one simple signature

GitLab and watchTowr provide the week's most actionable indicator: search logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ whose parameters contain a suspicious file.Path field (absolute paths, traversal sequences). Any occurrence predating the patch should be treated as potential configuration exfiltration.

What to do

The broader lesson

Two consecutive critical flaws on the same surface (GitLab's API) in three weeks, both mass-scanned within a day: the disclosure-to-exploitation conversion leaves no room for "next cycle" patching. For teams self-hosting GitLab, the core question is exposure: every public API of an internal instance is a reading door into your secrets. Auditing it — endpoints, actually enforced authentication, path confinement — is foundational work, not a one-off check.