GitLab path traversal flaw exploited in the wild
An actively exploited GitLab path traversal bug lets attackers read arbitrary files via the repository commits API, exposing SSH keys and credentials.
MS-ISAC has issued an advisory for a path traversal vulnerability (CVE-2026-85706) in GitLab's repository commits API, affecting all Community and Enterprise Edition versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. A single crafted HTTP request against the vulnerable API endpoint can allow an attacker to read arbitrary files on the server, potentially disclosing SSH keys, database credentials, deploy tokens, and CI/CD variables.
The advisory notes this vulnerability is actively being exploited in the wild, making it a priority patching item for any organization running self-hosted GitLab instances in the affected version ranges. Depending on what sensitive data is retrieved, an attacker could pivot to further compromise of the GitLab appliance or connected systems (e.g., via stolen deploy tokens or database credentials), potentially enabling supply-chain style attacks on downstream CI/CD pipelines.
Defenders should apply the vendor-provided stable channel update immediately after testing, restrict external exposure of GitLab instances where possible, and monitor for anomalous API requests to the commits endpoint. Standard hardening measures such as least privilege, vulnerability scanning of externally-exposed assets, and host-based intrusion detection are recommended alongside patching.
Mentioned in this report
Detection guidance
GitLab Repository Commits API Path Traversal Exploitation
Detects suspicious HTTP requests to GitLab commits API endpoint with path traversal patterns (../ sequences or encoded variants) attempting to read sensitive files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GitLab Repository Commits API Path Traversal Exploitation
description: Detects HTTP requests to GitLab repository commits API endpoints containing
path traversal sequences (../ or URL-encoded variants %2e%2e) commonly used to exploit
CVE-2026-85706. Targets the distinctive API pattern without over-fitting to specific
file paths.
tags:
- attack.t1190
logsource:
category: proxy
product: proxy
detection:
selection_api_path:
c-uri|contains: /repository/commits
selection_traversal:
c-uri|contains:
- ../
- ..\
- '%2e%2e/'
- '%2e%2e%5c'
condition: selection_api_path and selection_traversal
falsepositives:
- Legitimate developer tools or scripts performing repository introspection with malformed
paths
- API testing frameworks that inadvertently encode traversal patterns
level: high
id: 3627561a-2496-54e9-8a9d-52ae0c783fe6
status: experimental
author: Vorant
GitLab Commits API Request Reading Sensitive Configuration Files
Detects HTTP requests to GitLab commits API attempting to access typical sensitive file paths (.ssh, .env, database config, secrets) via path traversal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GitLab Commits API Request Reading Sensitive Configuration Files
description: Detects HTTP requests to GitLab repository commits API endpoints attempting
to read sensitive system or configuration files (SSH keys, environment variables,
database configs, credentials) via path traversal. Focuses on the distinctive sensitive
file patterns rather than one-off paths.
tags:
- attack.t1190
logsource:
category: proxy
product: proxy
detection:
selection_api:
c-uri|contains: /repository/commits
selection_sensitive_paths:
c-uri|contains:
- .ssh/
- .env
- database.yml
- secrets.yml
- credentials
- id_rsa
- config/database
- /root/
- /home/
condition: selection_api and selection_sensitive_paths
falsepositives:
- Legitimate GitLab documentation or config file review endpoints
- Authorized backup or configuration management tools querying file paths
level: high
id: d09c12ea-af5e-5ec1-ac0c-17d0a13281a6
status: experimental
author: Vorant
Anomalous HTTP GET Requests to GitLab Commits API Endpoint
Detects HTTP GET requests to GitLab commits API endpoint from unusual source IPs or with abnormally high request rate, indicative of active exploitation scanning. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Anomalous HTTP GET Requests to GitLab Commits API Endpoint
description: Detects HTTP GET requests targeting GitLab repository commits API endpoints
(/api/v*/projects/*/repository/commits) with indicators of automated exploitation
scanning, such as absence of typical User-Agent headers or referer patterns common
to legitimate GitLab web interface usage.
tags:
- attack.t1190
logsource:
category: proxy
product: proxy
detection:
selection_api:
c-uri|contains: /repository/commits
cs-method: GET
filter_legitimate_ua:
cs-User-Agent|contains:
- Mozilla
- GitLab
- Chrome
- Safari
filter_localhost:
cs-host|contains:
- 127.0.0.1
- localhost
- ::1
condition: selection_api and not filter_legitimate_ua and not filter_localhost
falsepositives:
- Curl/wget-based legitimate API calls by developers or automation tools
- API documentation tools without standard User-Agent headers
level: medium
id: 1b11d12d-f935-56cb-96b2-08a0c169aa37
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-gitlab-could-allow-for-disclosure-of-sensitive-data_2026-094
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free