GitLab vulnerability exploited by hackers, urgent updates recommended

The Cybersecurity and Infrastructure Security Agency (CISA) of the United States has added a new vulnerability in GitLab to the Known Exploited Vulnerabilities (KEV) catalog, warning users of the platform that it is actively being exploited by cybercriminals in real attacks.

GitLab has released updates for the Community Edition (CE) and Enterprise Edition (EE) to versions 19.3.2, 19.2.6, and a corresponding patch for the 19.1 branch, addressing several vulnerabilities. Among these are two critical vulnerabilities: a path traversal vulnerability in the repository commit API and an insecure deserialization issue in the GraphQL subscriptions serializer. The first vulnerability has been assigned the identifier CVE-2026-85706 with a maximum threat rating of 10 out of 10. It is related to a lack of mandatory authentication and improper access controls in the repository commit API, which allows unauthorized attackers to read sensitive information, including credentials and private data.

While GitLab has not reported any instances of these vulnerabilities being exploited in the wild, cybersecurity experts from watchTowr have indicated that attempts to exploit CVE-2026-85706 have been observed, stating it "allows attackers to read arbitrary files with a single HTTP request." Experts have warned that there is little time left before mass attacks begin and recommended checking log files for POST HTTP requests to URIs like "/api/v4/projects/{id}/repository/commits/" with parameters "file.path" to identify potential exploitation attempts. When CISA included this vulnerability in the KEV catalog, it effectively gave government organizations three days to update their software.