CISA Reportedly Adds Maximum-Severity GitLab Flaw to Exploited-Vulnerability Catalog
SecurityUnverifiedUpdated:
A maximum-severity GitLab flaw has reportedly moved from a patched vulnerability to one listed by CISA as actively exploited, tightening the response timeline for U.S. federal agencies.
Reported unauthenticated access to secrets
According to the report, attackers are exploiting CVE-2026-85706, a GitLab repository-commits API flaw involving missing authentication enforcement and improper path confinement. The flaw can allow unauthenticated attackers to read credentials, secrets, and other sensitive data from vulnerable servers. The report says CISA added it to its Known Exploited Vulnerabilities catalog.
GitLab had released fixes for CVE-2026-85706, while the company had not designated the flaw as actively exploited.
CISA reportedly added CVE-2026-85706 to its catalog of known exploited vulnerabilities and gave federal agencies three days to secure affected systems.
Fixes and the federal deadline
The article lists fixes in Community Edition and Enterprise Edition versions 19.3.2, 19.2.6, and 19.1. The reported change adds CISA’s exploited-vulnerability listing and a three-day deadline for federal agencies to the availability of patches.
Sources
- BleepingComputerCISA: Hackers now exploit max severity GitLab flaw in attacksRead source →