Do Son 
GitLab released security updates addressing eighteen security flaws on September 10, 2026. The vendor resolved several severe GitLab vulnerabilities across Community Edition and Enterprise Edition installations. Most critically, the release fixes an unauthenticated path traversal flaw holding a maximum severity rating. The advisory stated, “We strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.”
Track every GitLab CVE the moment it's exploited.
Get free email alertsWhy It Matters
Industry estimates indicate that over thirty million developers and one hundred thousand organizations use GitLab to manage private source code. Therefore, critical security flaws inside repository servers present massive risks to software supply chains. An intruder who breaches a source code repository can steal proprietary algorithms and expose cloud infrastructure credentials. Furthermore, attackers can alter release pipelines to inject malicious code into downstream enterprise software. Because development platforms store high-value corporate assets, unpatched servers remain primary targets for malicious actors.
How the Attack Works
Path Traversal and Data Exposure
The most severe vulnerability, CVE-2026-85706, carries a perfect CVSS score of 10.0. The flaw stems from missing access controls in the repository commits endpoint. Specifically, the advisory notes that “an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.” Attackers send crafted web requests to read sensitive system configuration files.
Deserialization and Buffer Overflows
Additionally, the update resolves CVE-2026-87719, an insecure deserialization flaw holding a CVSS score of 9.9. The security advisory explains that this issue “could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.”
Meanwhile, CVE-2026-88765 introduces a dangerous buffer overflow issue with a CVSS score of 8.5. Authenticated threat actors import malformed Git project exports to overflow memory during search indexing. Consequently, this memory corruption allows attackers to execute arbitrary system code on the host server. Other patched GitLab vulnerabilities address cross-site scripting and unauthorized variable exposure within continuous integration pipelines.
Affected Versions
These security flaws impact numerous releases of GitLab Community Edition and Enterprise Edition. In particular, CVE-2026-85706 affects all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. In contrast, cloud instances on GitLab.com already run the remediated software. GitLab Dedicated environments also remain protected. Currently, security researchers have confirmed no active exploitation in the wild. Furthermore, GitLab confirmed that no public proof-of-concept exploit code exists.
Patch and Mitigation Steps
System administrators must update self-managed instances to secure their development infrastructure immediately. Organizations should upgrade to versions 19.3.2, 19.2.6, or 19.1.8 without delay. Administrators can review the official GitLab patch release notes for upgrade instructions.
Currently, no practical workarounds exist for the path traversal vulnerability. However, administrators should restrict network access to self-managed web portals using virtual private networks. Limiting exposed administrative endpoints reduces the risk of automated reconnaissance while teams prepare their maintenance windows.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
