Live › vulnerability › CVE-2026-85706
Go to dashboardUnauthenticated path traversal in the GitLab CE/EE repository commits API (CVSS 10.0). An attacker sends a POST to /api/v4/projects/:id/repository/commits with an arbitrary server path in the file.path parameter, and can read server files such as CI/CD secrets, deploy tokens and SSH keys. CISA KEV lists it as exploited since September 2026. GitLab.com and Dedicated are already patched; self-managed instances must upgrade.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| GitLab Community Edition and Enterprise Edition | vendor | – | – |
| GitLab CE/EE | vendor | >= 18.7, < 18.11.12; >= 19.0, < 19.0.9; >= 19.1, < 19.1.8; >= 19.2, < 19.2.6; >= 19.3, < 19.3.2 | 18.11.12, 19.0.9, 19.1.8, 19.2.6, 19.3.2 |
| gitlab | vendor | >= 18.7.0, < 18.11.12 | 18.11.12 |
| gitlab | vendor |
| >= 19.0.0, < 19.0.9 |
| 19.0.9 |
| gitlab | vendor | >= 19.1.0, < 19.1.8 | 19.1.8 |
| gitlab | vendor | >= 19.2.0, < 19.2.6 | 19.2.6 |
| gitlab | vendor | >= 19.3.0, < 19.3.2 | 19.3.2 |
gitlab-rake gitlab:env:info or check Admin > Dashboard for the version18.11.12, 19.0.9, 19.1.8, 19.2.6 or 19.3.219.3.2, 19.2.6, 19.1.8, 19.0.9 or 18.11.12, or later in your release seriesWhat vendors did on their customers’ behalf. Holds only for traffic through them; patching is still the fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-09-30 · Changelog
New updates and improvements at Cloudflare.
September 30, 2026
This release introduces new detections to enhance protection against a specific GitLab path traversal vulnerability, alongside advanced generic rules targeting HTTP request smuggling, directory traversal, and command injection attempts.
Key Findings
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...cb14ded8 | N/A | Broken Access Control - Directory Traversal | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...0364bd7e | N/A | HTTP Request Smuggling - Request Body Anomaly - Beta | Log | Block | This rule is merged into the original rule "HTTP/2 Request Smuggling - Request Body Anomaly" (ID: ...1489d892). |
| Cloudflare Managed Ruleset | ...d498a69a | N/A | Command Injection - Generic 8 - body - Beta | Disabled | Disabled | This rule is merged into the original rule "Command Injection - Generic 8 - body" (ID: ...413592e2). |
| Cloudflare Managed Ruleset | ...87ae8cfc | N/A | GitLab - Path Traversal- CVE:CVE-2026-85706 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...549f7356 | N/A | Generic - Request routing cache inconsistency | N/A | Block | This is a new detection. |
This page as .md · .json · in your agent: get_signal("CVE-2026-85706")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.