GitLab Issues Emergency Patches After Critical File‑Read Bug Triggers Rapid Exploitation Attempts

GitLab has released a set of security updates that address several vulnerabilities, the most severe being a remote file‑read flaw identified as CVE‑2026‑85706 and assigned a perfect 10.0 CVSS score.

The defect originates from a path‑traversal weakness in the way GitLab processes certain requests, enabling an attacker to retrieve arbitrary files from the server’s file system without authentication.

Within a few hours of the vulnerability’s public disclosure, security researchers observed scanning activity across the internet targeting GitLab instances, confirming that the flaw was being probed in the wild.

In response, GitLab’s security team issued patches for both self‑managed installations and its hosted SaaS offering, accompanied by an advisory urging administrators to apply the updates without delay.

For organizations that run GitLab on premises, the ability to read unrestricted files raises the risk of exposing configuration data, source code repositories, and potentially sensitive authentication tokens.

Path‑traversal bugs are a common entry point for attackers; a CVSS rating of 10.0 signals a vulnerability that can be exploited remotely with no credentials and that can have a severe impact on confidentiality, integrity and availability.

The episode highlights the necessity of prompt patch management. GitLab recommends confirming that the latest version is deployed, reviewing server logs for anomalous file‑access patterns, and rotating any credentials that may have been accessed.

While no confirmed breach tied to this specific flaw has been reported, the early probing activity indicates that threat actors are actively seeking unpatched systems.

The swift disclosure by The Hacker News and GitLab’s rapid remediation underscore the collaborative nature of modern vulnerability handling, but also serve as a reminder that timely software updates remain a vital defense against high‑severity security issues.