Vulnerability

CVE-2026-85706

CVE identifier for a critical path traversal flaw in self-managed GitLab's commit API, letting unauthenticated attackers read server files; CVSS 10.0.

Current stories

securityConfirmed4 publishers

GitLab patches sandbox escape that lets Duo agent users run commands on self-hosted AI Gateways

GitLab patched CVE-2026-90970, a sandbox escape that lets any authenticated Duo Agent Platform user run arbitrary commands on a self-hosted AI Gateway. Customers on GitLab's hosted gateway are already protected, so the upgrade falls to Self-Managed shops that run their own.

Publishers:bleepingcomputer.com scworld.com securityaffairs.com thehackernews.com

Perspective Coverage

4 publishers

Builder: Builder 24%
Operator: Operator 59%
Investor: Investor 17%

Reality

Evidence78
Adoption: Not scored
Hype gap+15
Incentives: Not scored
Confidence74

productConfirmed3 publishers

GitLab's commits API returns server files to callers who never log in

GitLab's September 10 patch release closes CVE-2026-85706, a CVSS 10.0 path confinement failure in the repository commits API. GitLab.com was already patched, so the exposure sits with self-managed servers.

Publishers:dev.to devops.com infoq.com

Perspective Coverage

3 publishers

Builder: Builder 33%
Operator: Operator 62%
Investor: Investor 5%

Reality

Evidence72
Adoption: Not scored
Hype gap+5
Incentives30
Confidence70

securityOne report1 publisher

Metasploit ships a public exploit for an unauthenticated GitLab file-read flaw

Rapid7 published a Metasploit module for CVE-2026-85706, an unauthenticated file read it says is already exploited against self-hosted GitLab. Every CE and EE build from 18.7 stays exposed until 19.1.8, 19.2.6 or 19.3.2.

Publishers:blog.rapid7.com

Reality

Evidence55
Adoption: Not scored
Hype gap+15
Incentives35
Confidence55

buildConfirmed3 publishers

A file.path parameter in GitLab's commit API reads server files before authentication

The fix ships in 19.3.2, 19.2.6 and 19.1.8, and scanning for the flaw started the day after disclosure. Whether you can tell if a read succeeded on your instance depends on whether your proxy logs request bodies.

Publishers:dev.to docs.gitlab.com watchtowr.com

Perspective Coverage

3 publishers

Builder: Builder 22%
Operator: Operator 73%
Investor: Investor 5%

Reality

Evidence80
Adoption: Not scored
Hype gap+15
Incentives45
Confidence74

buildOne report1 publisher

ZoomEye's fingerprint for Cisco's exploited FMC bypass returned zero hosts

A single September 2026 KEV batch produced 1,262,273 GitLab matches and nothing at all for Cisco Secure Firewall Management Center, because the console holding one of the two 10.0 bugs is the one passive scanning cannot fingerprint.

Publishers:dev.to

Reality

Evidence45
Adoption55
Hype gap+10
Incentives70
Confidence50

buildOne report1 publisher

GitLab's commits API returns arbitrary files to an unauthenticated caller at CVSS 10.0

The fix for CVE-2026-85706 shipped on 10 September in 19.3.2, 19.2.6 and 19.1.8, and CISA listed the flaw as exploited the next day. A ZoomEye fingerprint count of 1,262,273 hosts does not report versions; it shows where to look.

Publishers:dev.to

Reality

Evidence62
Adoption38
Hype gap+15
Incentives78
Confidence55

buildOne report1 publisher

Check Point ships this week's VPN fix as a live patch for three versions and an upgrade for the rest

Two unauthenticated Check Point RCEs, a CVSS 10.0 GitLab path traversal and an already-exploited N-able flaw all came due on September 11. How fast each one closes depends on the release you happen to be running.

Publishers:dev.to

Reality

Evidence35
Adoption40
Hype gap+30
Incentives30
Confidence40