{"id":"CVE-2026-85706","kind":"vulnerability","aliases":["CVE-2026-85706"],"related":[],"title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9,…","description":"WAF Release - 2026-09-30 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nSeptember 30, 2026\n\n## WAF Release - 2026-09-30\n\nThis release introduces new detections to enhance protection against a specific GitLab path traversal vulnerability, alongside advanced generic rules targeting HTTP request smuggling, directory traversal, and command injection attempts.\n\nKey Findings\n\n- CVE-2026-85706: A path traversal vulnerability affecting GitLab.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...cb14ded8 | N/A | Broken Access Control - Directory Traversal | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...0364bd7e | N/A | HTTP Request Smuggling - Request Body Anomaly - Beta | Log | Block | This rule is merged into the original rule \"HTTP/2 Request Smuggling - Request Body Anomaly\" (ID: ...1489d892). |\n| Cloudflare Managed Ruleset | ...d498a69a | N/A | Command Injection - Generic 8 - body - Beta | Disabled | Disabled | This rule is merged into the original rule \"Command Injection - Generic 8 - body\" (ID: ...413592e2). |\n| Cloudflare Managed Ruleset | ...87ae8cfc | N/A | GitLab - Path Traversal- CVE:CVE-2026-85706 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...549f7356 | N/A | Generic - Request routing cache inconsistency | N/A | Block | This is a new detection. |","summary":"Unauthenticated path traversal in the GitLab CE/EE repository commits API (CVSS 10.0). An attacker sends a POST to /api/v4/projects/:id/repository/commits with an arbitrary server path in the file.path parameter, and can read server files such as CI/CD secrets, deploy tokens and SSH keys. CISA KEV lists it as exploited since September 2026. GitLab.com and Dedicated are already patched; self-managed instances must upgrade.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-09-11T00:00:00+00:00","products":[{"name":"GitLab Community Edition and Enterprise Edition","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"GitLab CE/EE","fixed":["18.11.12","19.0.9","19.1.8","19.2.6","19.3.2"],"affected":">= 18.7, < 18.11.12; >= 19.0, < 19.0.9; >= 19.1, < 19.1.8; >= 19.2, < 19.2.6; >= 19.3, < 19.3.2","ecosystem":"vendor"},{"name":"gitlab","fixed":["18.11.12"],"affected":">= 18.7.0, < 18.11.12","ecosystem":"vendor"},{"name":"gitlab","fixed":["19.0.9"],"affected":">= 19.0.0, < 19.0.9","ecosystem":"vendor"},{"name":"gitlab","fixed":["19.1.8"],"affected":">= 19.1.0, < 19.1.8","ecosystem":"vendor"},{"name":"gitlab","fixed":["19.2.6"],"affected":">= 19.2.0, < 19.2.6","ecosystem":"vendor"},{"name":"gitlab","fixed":["19.3.2"],"affected":">= 19.3.0, < 19.3.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","exploited","gitlab","gitlab-ce","gitlab-ee","lab-disclosure","path-traversal","self-hosted","unauthenticated","vendor"],"not_affected_if":["gitlab-com","gitlab-dedicated","managed-hosting"],"how_to_check":"Run 'gitlab-rake gitlab:env:info' or check Admin > Dashboard for the version. You are affected if you run 18.7 or later and are below 18.11.12, 19.0.9, 19.1.8, 19.2.6 or 19.3.2. To look for exploitation, search api_json.log and the Workhorse access log for POST /api/v4/projects/*/repository/commits requests with a file.path parameter pointing outside the upload directory, such as gitlab.yml. GitLab's support article explains how to use the Workhorse written_bytes field to tell whether file contents were sent back to the client.","fix":"Upgrade to 19.3.2, 19.2.6, 19.1.8, 19.0.9 or 18.11.12, or later in your release series. Versions before 18.7 are not listed as affected. If the instance was internet-exposed and unpatched, treat secrets as compromised: rotate CI/CD variables, runner tokens, deploy tokens, SSH keys and the credentials in gitlab.yml and gitlab-secrets.json.","status":"resolved","published_at":"2026-09-11T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:31+00:00","updated_at":"2026-10-24T17:31:15+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-23T20:31:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade GitLab CE/EE to the fixed version named in the vendor advisory (not stated in the sources); if no patch is available, follow the vendor mitigation instructions and CISA BOD 26-04 guidance.","summary":"GitLab Community Edition and Enterprise Edition contain a path traversal flaw in the repository commits API that lets an unauthenticated user read arbitrary files on the server. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["gitlab","self-hosted","gitlab-ce","gitlab-ee"],"confidence":0.6,"analyst_note":"Find the GitLab advisory for CVE-2026-85706 to get affected and fixed versions, the vendor mitigation, and whether gitlab.com or dedicated instances are impacted.","how_to_check":"Unknown from the sources. Check your GitLab version against the vendor advisory and review access logs for requests to the repository commits API from unauthenticated clients.","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"high"},"cost_usd":0.000414,"input_tokens":2243,"output_tokens":380,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the GitLab advisory for CVE-2026-85706 to get affected and fixed versions, the vendor mitigation, and whether gitlab.com or dedicated instances are impacted.","search":"'-09':125C,141C '-2026':20A,23A,175C,280C '-30':126C,142C '-85706':21A,24A,176C,281C '/api/v4/projects':76B '0364bd7e':215C '10.0':69B '1489d892':241C '18.11.12':15A '18.7':13A '19.0':16A '19.0.9':18A '2026':109B,124C,137C,140C '30':136C '413592e2':269C '549f7356':292C '8':250C,266C '87ae8cfc':273C 'access':201C 'action':191C,193C 'advanc':159C 'affect':9A,181C 'alongsid':158C 'alreadi':114B 'and':28A 'anomali':222C,239C 'api':67B 'arbitrari':80B 'attack':71B 'attempt':171C 'beta':223C,252C 'block':206C,225C,283C,300C 'bodi':221C,238C,251C,267C 'broken':200C 'cach':297C 'cb14ded8':198C 'ce':43B 'ce/ee':8A,32A,64B 'changelog':127C,128C 'ci/cd':94B 'cisa':101B 'cloudflar':38B,134C,195C,212C,242C,270C,289C 'command':169C,247C,263C 'comment':194C 'commit':66B 'community':26A 'control':202C 'cve':19A,22A,174C,278C,279C 'cvss':68B 'd498a69a':245C 'dedic':112B 'deploy':96B 'descript':189C 'detect':147C,211C,288C,305C 'directori':166C,203C 'disabl':253C,254C 'disclosur':49B 'edition':27A,30A 'ee':46B 'enhanc':149C 'enterprise':29A 'exploit':39B,106B 'file':91B 'file.path':85B 'find':173C 'generic':160C,249C,265C,294C 'gitlab':1A,7A,25A,31A,33A,34A,35A,36A,37A,40B,42B,45B,63B,154C,182C,275C 'gitlab-c':41B 'gitlab-e':44B 'gitlab.com':110B 'host':55B 'http':163C,217C 'http/2':234C 'id':185C,188C,240C,268C 'id/repository/commits':77B 'improv':132C 'inconsist':298C 'inject':170C,248C,264C 'instanc':119B 'introduc':145C 'issu':5A 'kev':102B 'key':100B,172C 'lab':48B 'lab-disclosur':47B 'legaci':186C 'list':103B 'log':205C,224C,282C 'manag':118B,196C,213C,243C,271C,290C 'merg':229C,258C 'must':120B 'n/a':199C,216C,246C,274C,293C,299C 'new':129C,146C,192C,210C,287C,304C 'origin':232C,261C 'paramet':86B 'patch':115B 'path':51B,59B,82B,155C,178C,276C 'path-travers':50B 'post':74B 'previous':190C 'protect':150C 'read':89B 'releas':123C,139C,144C 'remedi':3A 'repositori':65B 'request':164C,218C,220C,235C,237C,295C 'rout':296C 'rule':161C,184C,187C,227C,233C,256C,262C 'ruleset':183C,197C,214C,244C,272C,291C 'secret':95B 'self':54B,117B 'self-host':53B 'self-manag':116B 'send':72B 'septemb':108B,135C 'server':81B,90B 'sinc':107B 'smuggl':165C,219C,236C 'specif':153C 'ssh':99B 'target':162C 'token':97B 'travers':52B,60B,156C,167C,179C,204C,277C 'unauthent':56B,58B 'updat':130C 'upgrad':121B 'vendor':57B 'version':11A 'vulner':157C,180C 'waf':122C,138C","nicknames":[],"mitigations":[{"kind":"waf-rule","since":"2026-09-30","covers":"HTTP requests proxied through Cloudflare, via the Cloudflare Managed Ruleset rule 'GitLab - Path Traversal- CVE:CVE-2026-85706' (action changed from Log to Block)","limits":"none stated","source":"https://developers.cloudflare.com/changelog/post/2026-09-30-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T17:31:15Z","confidence":0.9,"source_title":"Cloudflare: WAF Release - 2026-09-30 · Changelog","customer_action":"none stated"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-11T00:00:00+00:00","kev":{"dateAdded":"2026-09-11","dueDate":"2026-09-14","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-85706","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85706","severity":null,"published_at":"2026-09-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-85706:118","url":null,"severity":null,"published_at":"2026-10-23T21:38:22+00:00","modified_at":"2026-10-23T21:38:22+00:00","first_seen_at":"2026-10-23T21:38:22+00:00","fetched_at":"2026-10-23T21:38:22+00:00","note":"GitLab advisory (patch release 19.3.2, backport 19.0.9/18.11.12) read: CVSS 10.0, affected 18.7+ before fixed versions; gitlab.com/Dedicated already patched; KEV-listed. No PoC link found; X posts were reposts, none saved. Severity raised high->critical per vendor CVSS 10.0 and KEV."},{"source":"nvd","external_id":"CVE-2026-85706","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85706","severity":null,"published_at":"2026-09-12T03:16:30+00:00","modified_at":"2026-09-24T12:52:28+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-09-30-waf-release/#CVE-2026-85706","url":"https://developers.cloudflare.com/changelog/post/2026-09-30-waf-release/","severity":null,"published_at":"2026-09-30T17:18:05+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: WAF Release - 2026-09-30 · Changelog"}],"documents":[{"id":1154,"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/","title":"GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1155,"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-0-9-released/","title":"GitLab Critical Patch Release: 19.0.9, 18.11.12","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1156,"url":"https://support.gitlab.com/hc/en-us/articles/30371082139164-Validating-whether-a-file-was-actually-exfiltrated-via-CVE-2026-85706-using-Workhorse-written-bytes","title":"Validating exfiltration via CVE-2026-85706 using Workhorse written_bytes","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1157,"url":"https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild/","title":"Rapid7: CVE-2026-85706 exploited in the wild","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2844,"url":"https://developers.cloudflare.com/changelog/post/2026-09-30-waf-release/","title":"Cloudflare: WAF Release - 2026-09-30 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-09-30 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nSeptember 30, 2026\n\n## WAF Release - 2026-09-30\n\nThis release introduces new detections to enhance protection against a specific GitLab path traversal vulnerability, alongside advanced generic rules targeting HTTP request smuggling, directory traversal, and command injection attempts.\n\nKey Findings\n\n- CVE-2026-85706: A path traversal vulnerability affecting GitLab.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...cb14ded8 | N/A | Broken Access Control - Directory Traversal | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...0364bd7e | N/A | HTTP Request Smuggling - Request Body Anomaly - Beta | Log | Block | This rule is merged into the original rule \"HTTP/2 Request Smuggling - Request Body Anomaly\" (ID: ...1489d892). |\n| Cloudflare Managed Ruleset | ...d498a69a | N/A | Command Injection - Generic 8 - body - Beta | Disabled | Disabled | This rule is merged into the original rule \"Command Injection - Generic 8 - body\" (ID: ...413592e2). |\n| Cloudflare Managed Ruleset | ...87ae8cfc | N/A | GitLab - Path Traversal- CVE:CVE-2026-85706 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...549f7356 | N/A | Generic - Request routing cache inconsistency | N/A | Block | This is a new detection. |","published_at":"2026-09-30T17:18:05+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}