CISA says attackers are exploiting a maximum-severity GitLab flaw that leaks secrets in one request

The US Cybersecurity and Infrastructure Security Agency has warned that hackers are exploiting a maximum-severity vulnerability in GitLab, the DevSecOps platform used by more than half of Fortune 100 companies and by over 30 million registered users. The flaw, tracked as CVE-2026-85706, stems from missing authentication enforcement and improper path confinement in the repository commits API. Unauthenticated attackers can use it to read credentials, secrets, and other sensitive information from vulnerable servers. GitLab fixed the issue on Thursday in Community Edition and Enterprise Edition versions 19.3.2, 19.2.6, and 19.1, and urged users to patch immediately. GitLab itself has not yet tagged the bug as actively exploited. Security firm watchTowr reported one day after the fix that attackers were already probing the internet for unpatched servers, describing the flaw as a path traversal that lets attackers read arbitrary files in a single HTTP request. Based on the history of recent GitLab bugs, watchTowr said indiscriminate exploitation was likely not far away, and advised defenders to hunt through log files for suspicious HTTP POST requests. CISA's warning now confirms that exploitation has begun. Organizations running self-managed GitLab should treat any exposed instance as potentially compromised, rotate secrets stored in affected repositories, and apply the fixed versions.