Home / Technology / CISA Warns: Unauthenticated GitLab File Access
CISA Warns: Unauthenticated GitLab File Access
14 Sep
Summary
- GitLab's critical path traversal flaw allows unauthenticated access to sensitive files.
- Active exploitation observed; CISA added the vulnerability to its KEV catalog.
- Agencies have three days to update GitLab versions to secure them.
The US Cybersecurity and Infrastructure Security Agency (CISA) has alerted users to an actively exploited critical vulnerability within GitLab. This path traversal flaw, CVE-2026-85706, permits attackers to access sensitive information without any authentication by exploiting the commits API.
Cybersecurity experts have confirmed in-the-wild exploitation attempts, highlighting the urgency of the situation. CISA's inclusion of this vulnerability in its Known Exploited Vulnerabilities (KEV) catalog mandates government agencies to apply the necessary patches within a strict three-day timeframe. GitLab has issued updates for its CE/EE versions to address this and other critical security issues.
GitLab, a key platform for DevSecOps professionals used by approximately half of the Fortune 100 companies, has released fixes in versions 19.3.2, 19.2.6, and 19.1. Organizations are strongly advised to update their systems promptly to mitigate the risk of further compromise.
