GitLab CVE-2026-85706 Path Traversal Enables Unauthenticated File Reads on Public Projects

GitLab patched the flaw in versions 19.1.8, 19.2.6, and 19.3.2 after watchTowr detected active exploitation hours after disclosure. The endpoint /api/v4/projects/{id}/repository/commits/ accepted unsanitized file.Path parameters, bypassing authentication checks when a public repository existed. CISA added the CVE to the KEV catalog the same day, mandating FCEB remediation by 14 September.

Procurement records and prior incident reports show GitLab instances frequently expose repository APIs to the internet for CI/CD pipelines. The second critical GitLab issue in weeks, following CVE-2026-19478 GraphQL injection, indicates recurring authentication and serialization gaps rather than isolated oversights. watchTowr telemetry confirms attackers first targeted log and configuration files to harvest secrets for downstream build poisoning.

Independent verification of exploitation remains limited to network telemetry; no public packet captures or malware samples have surfaced yet. Official statements attribute activity to opportunistic actors, but the rapid shift to mass scanning matches patterns seen after other high-severity self-managed platform disclosures.

Organizations must audit HTTP POST logs to the commits endpoint and restrict public project visibility where possible. Unpatched internet-facing instances face imminent mass exploitation risk within days.