GitLab patches max-severity commits API file-read flaw

GitLab posted a critical patch release for 19.3.2, 19.2.6, and 19.1.8 on 10 September 2026, led by CVE-2026-85706. The advisory describes a path traversal in the repository commits API that, under certain conditions, could let an unauthenticated user read arbitrary files from the GitLab server.

GitLab published the list of fixed CVEs and patched builds itself. The bug is rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). GitLab says the cause is improper path confinement plus missing authentication enforcement. s3ntago reported it via HackerOne.

Impacted builds are GitLab CE and EE, all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. GitLab.com is already running a patched version. GitLab Dedicated customers need no action. Self-managed operators are told to upgrade immediately to 19.1.8, 19.2.6, or 19.3.2.

The same release also patches CVE-2026-87719, an insecure deserialization issue in the GraphQL subscription serializer on GitLab EE, rated CVSS 9.9. That path needs an authenticated Duo Chat user.

The Hacker News said watchTowr observed in-the-wild probes from 06:00 UTC on 11 September 2026, including file reads of logs and config for secrets. Those reports describe scanning, not a confirmed mass compromise in every environment. OpenCVE lists CVE-2026-85706 in the Known Exploited Vulnerabilities catalog, with a due date of 14 September 2026. The commits-API bug follows Cyberpresso's earlier note on GitLab's GraphQL CVE-2026-19478, another unauthenticated GitLab issue that forced an out-of-band fix in August.

Some offers on this page may be paid placements or contain affiliate links.