Threat actors are exploiting a maximum-severity GitLab vulnerability disclosed last week, which could give adversaries an inside track into organizations' software supply chains.
CVE-2026-85706, which GitLab disclosed and patched on Sept. 10, is a path traversal flaw that allows unauthenticated individuals to read arbitrary files from the GitLab server. The vulnerability, which received a CVSS score of 10 out of 10, stems from improper path confinement and missing authentication checks in the platform's repository commits API, according to GitLab's advisory. The vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE), which organizations use to set up self-hosted GitLab instances within their environments.
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog on Friday and required federal agencies to patch or disable their self-managed GitLab instances by today. On the same day, researchers with cybersecurity vendor watchTowr observed behavioral probes for the flaw on its honeypot network.
And it's gotten worse since then.
GitLab Exploitation Jeopardizes Supply Chains
Jake Knott, head of threat intelligence at watchTowr, tells Dark Reading that malicious activity quickly escalated on Friday to full exploitation and the exfiltration of sensitive files.
"Over the weekend, we also observed threat actors dumping config files for secrets along with system SSH configurations for the victim system," Knott says. "The combination is, as you can imagine, potent, as it may allow threat actors the ability to extract passwords, connect to instances that allow password authentication, and gain access to the host under the right conditions."