Self-managed GitLab: unauth commits API file read hits CISA KEV

CISA added CVE-2026-85706 to the Known Exploited Vulnerabilities catalog today (2026-09-11). GitLab shipped the Critical Patch Release that closes it on September 10: 19.1.8 / 19.2.6 / 19.3.2. The bug is an unauthenticated path traversal in the repository commits API. Anyone who can reach a vulnerable self-managed instance can read arbitrary files off the GitLab server. That means repo secrets, SSH keys, .env files, and whatever else sits on disk under the GitLab service account.

GitLab.com is already patched. Dedicated customers have nothing to do. Self-managed operators on 18.7 through unpatched 19.3.x need to upgrade now. Federal agencies on KEV have a due date of 2026-09-14 and forensic triage is marked Yes.

What breaks

GitLab rates CVE-2026-85706 Critical, CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Improper path confinement plus missing auth enforcement on the repository commits API let an unauthenticated caller pull files from the server. Impacted: GitLab CE/EE all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Reporter: s3ntago via HackerOne. CWE-35.

The same Critical Patch Release also closes two EE-only siblings you should treat as part of the same upgrade, not separate tickets:

• CVE-2026-87719 Critical CVSS 9.9. Insecure deserialization in the GraphQL subscription serializer. An authenticated user with Duo Chat access can obtain Advanced Search instance configs and credentials via a crafted subscription argument. EE only, from 18.3 before the same fixed trains.
• CVE-2026-88765 High CVSS 8.5. Buffer overflow in a Unicode conversion wrapper used by Advanced Search indexing. An authenticated user can reach RCE by importing a crafted project export. EE only, from 12.3 before the same fixed trains. Attack complexity is High.

Lead with 85706. It needs no login, hits CE and EE, and is on KEV. The other two ride along when you upgrade.

Who is not in scope

• GitLab.com already runs the patched build. No action.
• GitLab Dedicated customers: vendor says no action required.
• Versions before 18.7 for CVE-2026-85706. The commits-API path traversal range starts at 18.7.
• CVE-2026-87719 and CVE-2026-88765 are Enterprise Edition only. CE instances are out of scope for those two. Both also need authentication (Duo Chat for 87719; project-import / Advanced Search path for 88765).

Operator check

Confirm your version before you declare yourself clear:

# Omnibus / package
dpkg -l gitlab-ce gitlab-ee 2>/dev/null | grep -E 'gitlab-(ce|ee)'
# or
rpm -q gitlab-ce gitlab-ee 2>/dev/null

# From the Rails console / rake helper
sudo gitlab-rake gitlab:env:info

In the Admin UI: Admin Area → Overview → Dashboard shows the running version. You need ≥ 19.1.8 on the 19.1 train, ≥ 19.2.6 on 19.2, or ≥ 19.3.2 on 19.3. Anything 18.7.x through unpatched 19.3.1 is still in the 85706 window.

If the instance is internet-facing and unpatched, treat file-read of secrets on the GitLab host as a realistic outcome and rotate credentials that lived under that service account after you upgrade.

How to fix

# Debian/Ubuntu Omnibus CE example (match your edition + train)
sudo apt-get update
sudo apt-get install gitlab-ce=19.3.2-*
# or 19.2.6-* / 19.1.8-* on older supported trains

# RHEL/CentOS Omnibus
sudo yum install gitlab-ce-19.3.2

Follow GitLab's Update docs for your install type (Omnibus, Helm, source). This patch includes database migrations. Single-node installs will take downtime while migrations finish. Multi-node can use zero-downtime procedures. 19.3.2 also ships post-deploy migrations you can run after the upgrade.

GitLab Runner updates are separate; bump the application first for these CVEs.

What this is not

CVE-2026-85706 is arbitrary file read, not remote code execution by itself. It is not a worm. SaaS / GitLab.com is already fixed. The blast radius that matters is self-managed, internet-facing instances on 18.7 through unpatched 19.3.x. The EE siblings (87719 / 88765) need auth and product features (Duo Chat / Advanced Search import) that not every install enables.

References

• GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8 (2026-09-10)
• CISA KEV: CVE-2026-85706, dateAdded 2026-09-11, dueDate 2026-09-14, forensicTriage Yes