GitLab’s CVSS 10 file-read is on KEV. Patching without hunting the commits API is not remediation.

Unauthenticated path traversal in the repository commits API. CISA KEV due 14 September with forensic triage. GitLab.com is patched; self-managed is not.

RWP Ventures · 2026-09-12 · event 2026-09-10 · 11 min read · priority 8.7

CISA added the CVE to KEV on 11 September. Federal due date is 14 September. Forensic-triage flag: Yes. That flag is the operational sentence: BOD 26-04 expects you to check whether the box was already read before you applied the patch. watchTowr’s Attacker Eye honeypot saw behavioral probes at 06:00 UTC on 11 September, less than a day after the advisory. That is reconnaissance and exploit-shaped traffic. It is not a GreyNoise-style victim census. Treat internet-facing self-managed GitLab that answered after 10 September as a secrets incident until the commits API logs say otherwise.

The same patch also closes CVE-2026-87719 (CVSS 9.9, GitLab EE GraphQL subscription serializer, authenticated). It is not KEV. Do not let the second critical distract from the unauthenticated one.

What happened

s3ntago reported CVE-2026-85706 through GitLab’s HackerOne program. GitLab’s 10 September critical patch names it a path-traversal issue in the repository commits API: improper path confinement plus missing authentication enforcement. Impacted: GitLab CE/EE all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. GitLab’s own wording is “under certain conditions.” Public independent reconstruction, which we will not turn into a recipe, converges on one practical precondition: the instance hosts at least one project the unauthenticated caller can address. GitLab.com and Dedicated are out of scope for operators.

CISA’s 11 September alert added a single KEV entry: CVE-2026-85706. Catalog JSON (2026.09.11, released 19:32 UTC): due 14 September, ransomware-use Unknown, forensic triage Yes, CWE-35. CVE.org maps CWE-22. Both describe the same class. Canadian Centre for Cyber Security’s AV26-917 the same day pointed operators at the KEV listing.

watchTowr reproduced the bug, validated exposure on self-managed client instances, and published the hunt string defenders actually need: HTTP POST to /api/v4/projects/{id}/repository/commits/ URIs that carry a file.path parameter. Jake Knott told SecurityWeek this is the second critical GitLab issue in recent weeks after GraphQL code injection CVE-2026-19478, which was exploited almost immediately. We have not independently confirmed a production-victim count. We have confirmed the KEV listing and the honeypot probes.

The 10 September release is not a one-CVE hotfix. It also patches CVE-2026-87719 (insecure deserialization in the GraphQL subscription serializer, EE, CVSS 9.9 — Duo Chat access, Advanced Search configs and credentials) and CVE-2026-88765 (authenticated RCE via a crafted project export overflowing a Unicode conversion buffer in Advanced Search indexing, EE, CVSS 8.5). Those are real. They are authenticated or EE-gated. CVE-2026-85706 is the internet-facing one.

Why it matters

Three facts should not be collapsed.

First: this is a secrets-read, not a claimed unauthenticated RCE. GitLab’s CVSS vector sets Availability to None and Integrity to High with Scope Changed. Independent write-ups describe error-oracle and file-content leakage from files the GitLab process can open — gitlab.yml, database.yml, tokens, SSH material, CI variable stores, depending on layout and what the process can read. Integrity High on a file-read CVE is GitLab’s scoring, not evidence that the commits API itself writes a webshell. Do not invent RCE. Do not downplay a file-read on a box that holds the org’s git, runners, and package registry credentials. Stolen CI tokens and clone credentials are how this becomes a supply-chain event.

Second: the KEV forensic-triage flag is not decoration. CISA’s BOD 26-04 language on this class of listing is that agencies must check whether threat actors compromised the system before the patch was applied. A GitLab that was reachable from untrusted networks on 10–12 September, even if it is 19.3.2 now, still needs the commits-API hunt. The patch stops the next POST. It does not tell you whether database.yml already left.

Third: self-managed GitLab is the estate, not GitLab.com. The vendor said so twice. Operators who “use GitLab” via gitlab.com can document that and move on. Operators who run Omnibus, Helm, or source installs — including air-gapped and plant-engineering instances that happen to be on a corporate DMZ — are the KEV population. We have no confirmed OT, ICS, or physical-process impact. An engineering GitLab that holds PLC project files is still an IT compromise of an industrial organization’s source repo. Do not write a process event.

Who / what is affected

Technical context

RWP is not reproducing request bodies, Workhorse upload variants, or parser-error oracles. GitLab’s public description is enough for a defender: the repository commits API did not confine paths and did not enforce authentication. watchTowr’s published hunt is enough for a SOC: unauthenticated POST to /api/v4/projects/{id}/repository/commits/ with a file.path parameter. Ethiack and others have discussed echo boundaries when a target file contains an illegal percent-encoding sequence. That is a detection footnote, not a how-to.

ATT&CK mapping for what is observed or directly implied by the CVE, not a hypothetical kill chain:

• Initial access / collection: exploit public-facing application (T1190) to unauthenticated file read
• Credential access: unsecured credentials in files the GitLab process can open (T1552) — assessed, configuration-dependent
• Follow-on that is not claimed for this CVE: RCE, webshell, ransomware

Public PoCs appeared on GitHub within a day of the advisory. Their existence is a mass-scan accelerant. We will not cite payloads.

Threat / exploitation status

High confidence on: vendor versions and CVSS, GitLab.com/Dedicated split, KEV listing, due date, forensic-triage flag, watchTowr’s 06:00 UTC 11 September honeypot timestamp as their telemetry. Moderate confidence that indiscriminate scanning is underway (honeypot probes plus public PoCs). Low confidence on remaining unpatched internet-facing population and on whether file-reads have already been converted into CI-token abuse.

What defenders should do

1. Inventory every self-managed GitLab. Version, CE vs EE, whether the instance is reachable from untrusted networks, whether it hosts public projects, whether runners and package registries share the host. Include contractor, university, and plant-engineering instances. GitLab.com / Dedicated: document and close.
2. Upgrade now to 19.3.2, 19.2.6, or 19.1.8 on the branch you run. GitLab published no workaround. Until the upgrade finishes, reduce reachability: SSO/VPN/allowlist in front of the instance; WAF or reverse-proxy deny on /api/v4/projects//repository/commits. That is exposure reduction, not a fix. GitLab notes the patch includes database migrations; single-node upgrades incur downtime; multi-node can follow the vendor’s zero-downtime procedure.
3. Hunt before you call the upgrade a close, because forensic triage is Yes. Access and Workhorse logs: HTTP POST to /api/v4/projects/{id}/repository/commits/ with file.path. Unusual 400s on that route. Unauthenticated hits against a project ID that exists. If those land after 10 September, rotate what the GitLab process could read: gitlab.yml / database.yml secrets, CI/CD variables, deploy tokens, runner tokens, package-registry credentials, SSH host keys and user keys the process can open, OmniAuth / SAML secrets. Rebuild is not automatically required for a file-read CVE; rotation of anything that file-read could have touched is.
4. Do not stop at 85706. Same build closes 87719 and 88765 on EE. If Duo Chat / Advanced Search is on, treat 87719 as a credential-theft bug for an authenticated user and hunt GraphQL subscriptions accordingly. That hunt is second to the unauthenticated commits API.
5. Sequence the rest of this week’s KEV clock. Cisco FMC CVE-2026-20079, Citrix NetScaler CVE-2026-19490, and Fortinet CVE-2025-25249 were due today, 12 September — see [10 September Daily Top](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/). PaperCut CVE-2026-81578 / CVE-2026-82078 and this GitLab CVE share 14 September. ScreenConnect CVE-2026-84869 also due 14 September (client 26.6.5, then reinstall host clients and access agents; servers not impacted). Artifactory CVE-2026-42016 / 42018 due 25 September — hunt admin accounts and Groovy plugins if self-hosted; 82329’s federal date already lapsed 5 September.

This is not an exploitation guide. Use GitLab’s patch notes, CISA KEV, and watchTowr’s hunt string.

RWP assessment

Score 8.7. An unauthenticated CVSS 10 on the product that holds source and CI secrets, KEV’d with forensic triage the next day, with honeypot probes inside 24 hours of the patch, is the first material development after [yesterday’s PaperCut AI-agent census](/posts/2026-09-11-papercut-ai-agent-campaign/). RWP had never published CVE-2026-85706. The increment is not “GitLab released a patch.” It is CISA’s listing, the triage flag, and confirmed scanning.

It outranks JFrog Artifactory CVE-2026-42016 / CVE-2026-42018 joining KEV on 11 September (due 25 September, forensic triage No). Wiz’s 10 September write-up — anonymous JWT, scope-bypass to admin, Groovy plugins, Rust backdoor, join-key theft — is the worse supply-chain picture, and we flagged it as a hunt yesterday. The new KEV rows are a clock, not a new victim picture. 82329 has been KEV since 2 September. Hunt self-hosted Artifactory this week. It is not today’s unauthenticated, 14 September, forensic-triage decision.

It outranks ConnectWise ScreenConnect CVE-2026-84869 (KEV 11 September, due 14 September, forensic triage Yes, CVSS 9.9). ConnectWise: client-side file transfer and execute during an active Support/Access session; servers not impacted; fix 26.6.5 then refresh host clients and access agents. Huntress told Help Net Security the rogue-client worm-like activity they published 3 September aligns with this CVE. That is MSP-relevant and it shares the 14 September date. It requires an active session (PR:L). GitLab does not.

It outranks Check Point CVE-2026-85102 / CVE-2026-85103 (CVSS 9.8 VPN certificate handling, disclosed 9 September). Check Point says it found both internally and has no evidence of exploitation. Patch via LivePatch or Jumbo. Real perimeter work. Not KEV.

What we are watching

• Whether a named crew converts GitLab file-reads into CI-token theft or registry poisoning, and whether CISA flips the ransomware-use flag.
• Remaining internet-facing self-managed GitLab on 18.7–19.3.1 after 14 September.
• CVE-2026-87719 / 88765: any KEV or in-the-wild reporting.
• Artifactory 42016/42018: additional victim reporting; admin names jfrog-distribution / jfrog-insight / repo-service; payloads under /tmp/.z.
• ScreenConnect 84869: whether Huntress’s worm-like client pattern expands past the 3–8 September window.
• PaperCut 81578/82078 and GitLab 85706 sharing the 14 September due date; MikroTik CVE-2026-86060 was due 13 September.

Sources

• GitLab — Critical Patch Release: 19.3.2, 19.2.6, 19.1.8
• CVE.org — CVE-2026-85706
• CISA — Adds One Known Exploited Vulnerability to Catalog, 11 September 2026
• CISA Known Exploited Vulnerabilities Catalog
• CISA — BOD 26-04
• watchTowr — Rapid Reaction: CVE-2026-85706
• SecurityWeek — GitLab vulnerability exploited one day after disclosure
• CyberScoop — GitLab’s critical flaw is already drawing internet-wide probes
• BleepingComputer — GitLab urges users to patch max severity path traversal flaw
• Canadian Centre for Cyber Security — GitLab security advisory AV26-917
• Wiz — Artifactory under attack (CVE-2026-42016 / 42018 / 82329)
• ConnectWise — ScreenConnect 26.6.5 security bulletin
• [RWP Daily Top, 11 September 2026 — PaperCut AI-agent campaign](/posts/2026-09-11-papercut-ai-agent-campaign/)
• [RWP Daily Top, 10 September 2026 — Cisco FMC CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/)