CVE-2026-85706

CriticalCVSS 10.0/10Known exploited (CISA KEV)Last modified Sep 24, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 18.7, < 18.11.12; >= 19.0, < 19.0.9; >= 19.1, < 19.1.8; >= 19.2, < 19.2.6; >= 19.3, < 19.3.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/627748Broken Link
https://hackerone.com/reports/3909881Permissions Required
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706Third Party Advisory, US Government Resource

Timeline

Published: Sep 12, 2026
Last modified: Sep 24, 2026
Added to CISA KEV: Sep 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-857095.3LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text CVE-2026-85718.3Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the CVE-2026-857149.1Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated adminis CVE-2026-857157.5ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in ge CVE-2026-857163.7The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3 CVE-2026-857176.8The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2 CVE-2026-857185.9The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3 CVE-2026-857197.5The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2 CVE-2026-85723.1Insufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised CVE-2026-857205.9The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2 CVE-2026-857217.5The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2 CVE-2026-857249.6Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOpera