Critical Repository API Bug Exposes Sensitive Server Files

A critical vulnerability in GitLab’s repository commits API is already being targeted in the wild, with attackers probing exposed self-hosted instances less than 24 hours after disclosure.


Tracked as CVE-2026-85706 and rated CVSS 10.0, the flaw can allow an unauthenticated attacker to retrieve arbitrary files from a vulnerable server through a specially crafted HTTP request.


Attackers Began Probing Within a Day

GitLab disclosed the vulnerability on September 10, 2026. By September 11, security researchers were detecting active exploitation attempts.


watchTowr reported observing internet-based probes targeting the flaw and warned organizations operating publicly accessible self-hosted GitLab installations to patch immediately or remove them from public access.


One Request Can Expose High-Value Data

The vulnerability affects the repository commits API and can be abused to read files that should remain inaccessible.


Depending on the server configuration, exposed information could include:


- SSH private keys
- Database credentials
- Deploy tokens
- CI/CD variables
- Cloud credentials
- Other sensitive configuration files


The risk is particularly serious because exploitation does not require prior authentication.


Which GitLab Releases Are Vulnerable?

The affected releases include Community Edition and Enterprise Edition versions:


- 18.7 through 19.1.7
- 19.2 through 19.2.5
- 19.3 through 19.3.1


GitLab has released fixes in 19.1.8, 19.2.6, and 19.3.2.


Another Security Issue Was Fixed

The same update cycle also addresses CVE-2026-87719, an insecure deserialization vulnerability that could expose advanced-search configuration and credentials.


For organizations running affected versions, upgrading is therefore preferable to relying on temporary mitigation measures.


Defenders Can Hunt for Exploitation Attempts

Security teams should review GitLab access logs for unusual POST requests targeting:


/api/v4/projects/{id}/repository/commits/


Requests containing a file.path parameter deserve particular attention because they can indicate attempts to exploit the traversal flaw.


Patch First, Then Rotate Exposed Secrets

Organizations should upgrade vulnerable installations immediately and investigate logs for evidence of successful exploitation.


If sensitive files may have been accessed, defenders should rotate potentially exposed SSH keys, access tokens, CI/CD credentials and cloud secrets after determining the scope of the incident.


Rapid Exploitation Raises the Pressure

The speed of exploitation follows a pattern seen with previous GitLab file-reading vulnerabilities. CVE-2023-2825, another flaw capable of arbitrary file disclosure, also came under attack shortly after disclosure.


The latest incident reinforces the danger of leaving internet-facing GitLab infrastructure unpatched, particularly when the vulnerability provides unauthenticated access to potentially valuable secrets.