A CVSS 10.0 vulnerability in GitLab Community and Enterprise Editions allows unauthenticated attackers to read arbitrary files via the repository commits API. Patched Sept 10, confirmed in CISA's Known Exploited Vulnerabilities catalog with real-world attacks underway.
High-impact, easily exploitable flaw hitting widely-used DevOps infrastructure immediately after patch release. Affects self-managed instances and risks exposure of configs, credentials, and source code. Underscores urgency around supply-chain security and timely patching. Security teams emphasized monitoring for POST requests to `/api/v4/projects/{id}/repository/commits/`.
9
1 post, first seen 11h ago
A CVSS 10.0 vulnerability in GitLab Community and Enterprise Editions allows unauthenticated attackers to read arbitrary files via the repository commits API. Patched Sept 10, confirmed in CISA's Known Exploited Vulnerabilities catalog with real-world attacks underway.
High-impact, easily exploitable flaw hitting widely-used DevOps infrastructure immediately after patch release. Affects self-managed instances and risks exposure of configs, credentials, and source code. Underscores urgency around supply-chain security and timely patching. Security teams emphasized monitoring for POST requests to `/api/v4/projects/{id}/repository/commits/`.
Read0nlyNet@Read0nlyNetCISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalogue after citing evidence of active exploitation. GitLab has released fixed versions for affected self-managed CE and EE installations, but the response also requires checking whether exposed servers were…
Not enough discussion yet.
No sentiment analysis available yet.
Read0nlyNet@Read0nlyNetCISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalogue after citing evidence of active exploitation. GitLab has released fixed versions for affected self-managed CE and EE installations, but the response also requires checking whether exposed servers were…
Not enough discussion yet.
No sentiment analysis available yet.
—
Not ranked yet
—
Not ranked yet