GitLab CVE-2026-85706: a 10-point flaw and the versions you must update

A bug in the repository commits API: paths are restricted incorrectly and the authentication check is missing. An attacker without an account can reach files outside the repository: logs, configuration, credentials and access tokens. A 10 out of 10 rating means remote exploitation without privileges and full data compromise.

The list is short, but exact numbers matter.

• Vulnerable: GitLab CE and EE 18.7–19.1.7, 19.2–19.2.5, 19.3–19.3.1.
• Fixed: 19.3.2, 19.2.6, 19.1.8.
• A second flaw in the same release: CVE-2026-87719, 9.9 points, insecure deserialisation in GitLab EE GraphQL subscriptions, reachable by authenticated users.

Steps from simplest to most laborious.

• Install the patch version of your branch without waiting for a maintenance window.
• If updating today is impossible, restrict public access to the instance at the network level.
• Check logs for suspicious requests to /api/v4/projects/{id}/repository/commits/ over recent weeks.
• On signs of exploitation, rotate tokens, keys and passwords that could have been in accessible files.

Self-hosted GitLab gets installed 'just in case' and goes unupdated for years. Such instances are the first ones scanners find. If there is no update process, the minimum protection is to put the instance behind VPN or ZTNA and subscribe to GitLab security releases.

CVE-2026-85706 is a rare 10-point vulnerability in a mass-market product. Update to 19.3.2, 19.2.6 or 19.1.8, check logs and rotate secrets at the slightest suspicion.