GitLab's Critical Flaw: Why Attackers Moved in Hours

Robert Moore · 2026-09-11

When a security flaw gets a perfect 10.0 severity score, you know it's serious. GitLab just patched one of those, and the timing tells a story worth paying attention to. The vulnerability, tracked as CVE-2026-85706, is a path traversal issue in the repository commits API. In plain English? An unauthenticated attacker could potentially read arbitrary files from the GitLab server. That means sensitive data—source code, configuration files, maybe even credentials—could be exposed without any login required. ### What Exactly Happened? GitLab released patches for multiple flaws, but this one stood out. Within hours of public disclosure, security researchers started seeing probes in the wild. That's fast. Really fast. It suggests attackers were either waiting for the patch or quickly weaponized the details once they went public. The flaw lives in the repository commits API. If you're not familiar, that's the part of GitLab that handles commit history and file changes. A path traversal bug there could let someone trick the system into reading files outside the intended directory—like reaching into a locked cabinet through a crack in the wall. ### Why You Should Care If your team uses GitLab—and millions do—this isn't just another patch to ignore until next quarter. The unauthenticated aspect makes it especially dangerous. No credentials needed. No warning signs. Just a crafted request and potentially full read access to files on the server. And here's the thing: in-the-wild probes mean real attackers are actively looking for vulnerable instances. They're scanning, testing, and likely building exploits. You don't want to be the one who left the door open. ### What Should You Do Right Now? - **Patch immediately.** GitLab has released fixes. Apply them. Don't wait for your next maintenance window. - **Check your logs.** Look for unusual requests to the repository commits API. Anything that seems like it's trying to traverse directories is a red flag. - **Review your exposure.** If your GitLab instance is internet-facing, you're at higher risk. Consider restricting access where possible. - **Stay informed.** Follow GitLab's security advisories and keep an eye on CVE databases for updates. ### The Bigger Picture This isn't the first time a critical GitLab flaw has drawn rapid attention, and it won't be the last. What's notable here is the speed. Hours. That's the new normal for high-severity vulnerabilities. Attackers are organized, automated, and relentless. For security teams, it's a reminder that patch management isn't just a checkbox. It's a race. And sometimes, the starting gun fires the moment the vulnerability goes public. So, if you haven't already, go check your GitLab version. Apply the patch. And maybe pour yourself a coffee—because the next few days might be busy. Stay safe out there.