A CVSS 10.0 flaw in GitLab Community/Enterprise Edition allows unauthenticated arbitrary file-read attacks via repository commits API. GitLab patched September 10; CISA confirmed in-the-wild exploitation by September 11. Self-managed instances remain at risk with no workaround.
Maximum-severity vulnerability affecting a widely-used DevOps tool, exploited days after patching. Highlights supply-chain security risks and the urgency of rapid patch deployment in self-hosted environments. Discussions emphasize credential rotation post-patch to mitigate compromised secrets.
71
2 posts, first seen 17h ago
A CVSS 10.0 flaw in GitLab Community/Enterprise Edition allows unauthenticated arbitrary file-read attacks via repository commits API. GitLab patched September 10; CISA confirmed in-the-wild exploitation by September 11. Self-managed instances remain at risk with no workaround.
Maximum-severity vulnerability affecting a widely-used DevOps tool, exploited days after patching. Highlights supply-chain security risks and the urgency of rapid patch deployment in self-hosted environments. Discussions emphasize credential rotation post-patch to mitigate compromised secrets.
CVE Brief@DailyCVEBriefDEEP DIVE: CVE-2026-85706 is an unauthenticated arbitrary file read in GitLab CE/EE, CVSS 10.0. Patched Sept 10, KEV-listed Sept 11, probed the same day. Self-managed only, and there is no workaround. Patching does not undo what was already read: rotate your secrets.
FIKSCloud@fiks_cloudA CVSS 10.0 in self-managed GitLab. No login needed. Exploited within a day of the patch, now on CISA's KEV list. The interesting part isn't the CVE. It's what most teams skip right after patching. 🧵
Not enough discussion yet.
No sentiment analysis available yet.
Not enough discussion yet.
No sentiment analysis available yet.
CVE Brief@DailyCVEBriefDEEP DIVE: CVE-2026-85706 is an unauthenticated arbitrary file read in GitLab CE/EE, CVSS 10.0. Patched Sept 10, KEV-listed Sept 11, probed the same day. Self-managed only, and there is no workaround. Patching does not undo what was already read: rotate your secrets.
FIKSCloud@fiks_cloudA CVSS 10.0 in self-managed GitLab. No login needed. Exploited within a day of the patch, now on CISA's KEV list. The interesting part isn't the CVE. It's what most teams skip right after patching. 🧵
—
Not ranked yet
—
Not ranked yet