# GitLab unauthenticated file-read flaw exploited

Published: 2026-09-12 · Severity: severe · Sectors: technology
Canonical: https://vorant.io/reports/3c9e6c02-9980-584a-b44e-2bc8cff42e59/gitlab-unauthenticated-file-read-flaw-exploited

> A critical unauthenticated path traversal in GitLab's commits API lets attackers read arbitrary files, is in CISA's KEV list, and has public exploit code.

NCSC-NL published a high-priority advisory for CVE-2026-85706, a path traversal and missing authentication vulnerability in the repository commits API of GitLab Community and Enterprise Editions. The flaw stems from improper path confinement combined with an API endpoint that lacks authentication checks, allowing unauthenticated attackers to read arbitrary files on the underlying system. The vulnerability carries a maximum CVSS v3 score of 10.0.

CISA has added CVE-2026-85706 to its Known Exploited Vulnerabilities catalogue, and public exploit code is available, indicating active or imminent exploitation. Internet-facing, self-managed GitLab instances are at greatest risk since no credentials are required to trigger the flaw and sensitive files (which could include configuration files or credentials) can be exfiltrated.

GitLab has released fixed versions 19.1.8, 19.2.6, and 19.3.2. Defenders should patch immediately, review API access logs for suspicious requests containing parameters such as file.path, and rotate any credentials that may have been exposed if signs of exploitation are found.

## Mentioned in this report

- Vulnerabilities: CVE-2026-85706 (KEV)

## Detection guidance (public sample)

### GitLab Unauthenticated Repository API Path Traversal

ATT&CK: T1190

Detects unauthenticated HTTP requests to GitLab repository commits API endpoint with path traversal sequences in file.path parameter. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: GitLab Unauthenticated Repository API Path Traversal
description: Detects exploitation of CVE-2026-85706 - unauthenticated requests to
  GitLab repository API with path traversal patterns (../) in file.path parameter,
  indicative of arbitrary file read attempts.
tags:
- attack.t1190
logsource:
  category: proxy
  product: network
detection:
  selection:
    http_method: GET
    uri|contains: ../
  filter_authenticated:
    http_user_agent|contains:
    - gitlab-runner
    http_authorization|exists: true
  condition: selection and not filter_authenticated
falsepositives:
- Legitimate path traversal in file picker or archive extraction tools
- API testing frameworks validating path handling
level: high
id: 3e3410d1-4b83-5b0d-9fe1-75555c8e844f
status: experimental
author: Vorant
```

### GitLab API Access Without Authentication Header

ATT&CK: T1190

Detects unauthenticated access attempts to GitLab commits or repository API endpoints lacking standard authentication tokens or session cookies. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: GitLab API Access Without Authentication Header
description: Detects unauthenticated HTTP requests to GitLab repository or commits
  API endpoints - CVE-2026-85706 exploitation typically lacks Authorization headers
  or valid session cookies.
tags:
- attack.t1190
logsource:
  category: proxy
  product: network
detection:
  selection:
    http_method: GET
    uri|contains:
    - /api/v4/projects/
    - /repository/commits
  filter_has_auth:
    http_authorization|exists: true
  filter_has_cookie:
    http_cookie|contains: _gitlab_session
  filter_internal_ci:
    source_ip|cidr:
    - 127.0.0.0/8
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not (filter_has_auth or filter_has_cookie or filter_internal_ci)
falsepositives:
- Public API endpoints intentionally left unauthenticated
- API documentation or schema endpoints
level: medium
id: eaba5be8-d346-5eca-9e1e-88d0904ebf17
status: experimental
author: Vorant
```

### GitLab Sensitive File Exfiltration via Path Traversal

ATT&CK: T1005

Detects HTTP requests targeting GitLab API with file.path parameters pointing to common sensitive system or application configuration files (etc/passwd, .env, config files). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: GitLab Sensitive File Exfiltration via Path Traversal
description: Detects exploitation attempts reading common sensitive files via GitLab
  API path traversal - targets /etc/passwd, environment files, SSH keys, or database
  credentials in config paths.
tags:
- attack.t1005
- attack.t1190
logsource:
  category: proxy
  product: network
detection:
  selection:
    uri|contains: file.path
  sensitive_paths:
    uri|contains:
    - /etc/passwd
    - /etc/shadow
    - /.env
    - /config/database.yml
    - /.ssh/id_rsa
    - /root/.bash_history
    - /var/www/html/config/
    - /home/git/.ssh/
  condition: selection and sensitive_paths
falsepositives:
- Legitimate file exploration or backup tools with path traversal checks
level: high
id: a51fa7cd-d5be-5d24-90c4-38331a640a17
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0367.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3c9e6c02-9980-584a-b44e-2bc8cff42e59/gitlab-unauthenticated-file-read-flaw-exploited.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup