GitLab CVE-2026-85706 Path Traversal Exploited 24 Hours After Patch

WatchTowr telemetry recorded the first in-the-wild probes on Friday targeting the path traversal flaw that permits single-request arbitrary file reads from GitLab servers. The same advisory also shipped patches for CVE-2026-87719, an insecure deserialization issue in the GraphQL subscription serializer that exposes Advanced Search configurations and credentials, plus six additional high-severity flaws enabling RCE and CI/CD variable theft.

Procurement records and GitLab release notes show consistent delays between disclosure and self-hosted deployment; prior critical issues in 2024 exhibited 40-60% unpatched instances at the 72-hour mark. The pattern indicates defenders relying on vendor announcements rather than automated update pipelines repeatedly leave file systems and credential stores exposed to immediate post-disclosure campaigns.

Log hunting criteria are explicit: inspect for HTTP POSTs to the commits endpoint with file.path parameters. Self-hosted administrators must apply 19.1.8, 19.2.6, or 19.3.2 immediately; cloud instances receive the fixes automatically but still require audit of prior access logs for evidence of compromise.

Operational risk centers on rapid weaponization: mass scanning is expected within days given the trivial unauthenticated vector and high-value targets holding source code and pipeline secrets.