CISA Warns of Active Attacks Exploiting Critical GitLab Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are actively exploiting a maximum-severity GitLab vulnerability tracked as CVE-2026-85706. The flaw stems from missing authentication enforcement and improper path confinement in the repository commits API, allowing unauthenticated attackers to read credentials, secrets, and other sensitive files from vulnerable servers in a single HTTP request. GitLab's DevSecOps platform is used by over 50% of Fortune 100 companies and has more than 30 million registered users worldwide.
GitLab fixes the issue in Community Edition and Enterprise Edition versions 19.3.2, 19.2.6, and 19.1, and urges users to patch immediately. Cybersecurity firm watchTowr reports that attackers are already probing the Internet for unpatched GitLab servers, noting that indiscriminate exploitation is likely not far away. The firm advises defenders to hunt through log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters to identify potential exploitation attempts.
CISA adds the vulnerability to its Known Exploited Vulnerabilities catalog and gives federal agencies three days to secure their systems under Binding Operational Directive 26-04. While the directive applies only to federal agencies, CISA encourages all network defenders, including private sector organizations, to patch as soon as possible and prioritize remediation of KEV Catalog vulnerabilities. These types of flaws are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.