GitLab issues urgent patches for exploited critical flaw

GitLab has issued emergency security updates for self-managed installations after fixing two critical vulnerabilities, including a maximum-severity flaw now listed by US authorities as actively exploited.

The company released GitLab Community Edition and Enterprise Edition versions 19.3.2, 19.2.6 and 19.1.8 on September 10, urging administrators running affected versions to upgrade immediately. GitLab. com is already operating the patched release, while GitLab Dedicated customers do not need to take action.

The most serious flaw, CVE-2026-85706, carries a CVSS score of 10.0 and affects both Community Edition and Enterprise Edition. GitLab said improper path confinement and missing authentication enforcement in the repository commits API could allow an unauthenticated attacker, under certain conditions, to read arbitrary files from a vulnerable server.

The US Cybersecurity and Infrastructure Security Agency added CVE-2026-85706 to its Known Exploited Vulnerabilities catalogue on September 11, signalling evidence of exploitation in the wild. The agency set a September 14 remediation deadline for organisations covered by its binding operational requirements and directed affected users to apply vendor mitigations.

GitLab said the security fixes apply across deployment types unless an advisory explicitly limits a vulnerability to a particular installation method. Administrators therefore need to assess Omnibus, source-code and Helm-based deployments against the affected version ranges rather than assuming a packaging format is exempt. CISA’s catalogue entry does not identify the exploitation method or attribute activity to a threat actor, and it lists ransomware use as unknown. The agency nevertheless requires forensic triage for covered systems because the path-traversal flaw has crossed from a theoretical software weakness into a vulnerability with confirmed exploitation activity.

The flaw affects GitLab CE and EE versions from 18.7 up to, but not including, 19.1.8; the 19.2 series before 19.2.6; and the 19.3 series before 19.3.2. GitLab credited a security researcher using the name s3ntago with reporting the issue through its HackerOne bug bounty programme.

A second critical vulnerability, CVE-2026-87719, affects GitLab Enterprise Edition and is rated 9.9. GitLab said an authenticated user with Duo Chat access could, under certain conditions, submit a specially crafted GraphQL subscription argument to bypass serialization controls and perform server object lookups.

Successful exploitation could expose Advanced Search instance configurations and sensitive credentials. The vulnerability affects Enterprise Edition versions from 18.3 before 19.1.8, the 19.2 branch before 19.2.6 and the 19.3 branch before 19.3.2. The company credited researcher kyyblin with reporting it through HackerOne.

The same patch release also addresses CVE-2026-88765, a high-severity buffer overflow in Enterprise Edition that could permit remote code execution. GitLab assigned the vulnerability a CVSS score of 8.5.

According to the company’s advisory, an authenticated user could trigger the flaw by importing a specially crafted Git project export. The malformed project could overflow a Unicode conversion buffer used during Advanced Search indexing, potentially allowing attacker-controlled code to run on the server.

That vulnerability reaches much further back than the two critical issues. GitLab said Enterprise Edition versions from 12.3 before 19.1.8 are affected, along with 19.2 releases before 19.2.6 and 19.3 releases before 19.3.2. Researcher joaxcar reported the defect through the company’s bug bounty channel.

Several additional high-severity fixes were bundled into the release. One, CVE-2026-79708, could allow a developer-level user to run a scheduled pipeline execution-policy test against projects in the user’s group and access protected CI/CD variables intended for more privileged roles. Another, CVE-2026-78252, concerns improper sanitisation in the Markdown JSON table renderer and could enable a targeted user to be induced into making unintended state-changing HTTP requests.

GitLab also fixed CVE-2026-13210, rated 7.7, in the CI/CD environment-variable scope matcher. Improper input validation could allow an authenticated user to obtain CI/CD variables outside their intended environment scope.

Two separate denial-of-service vulnerabilities in GraphQL complexity-limiting logic, CVE-2025-14871 and CVE-2026-1168, were rated 7.5. GitLab said unauthenticated users could exploit improper resource-allocation limits to cause a denial of service.