GitLab critical vulnerability exploited by malicious actors

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in GitLab’s development platform to its Known Exploited Vulnerabilities catalog. The flaw, tracked as CVE-2026-85706, allows unauthenticated users to access sensitive files from software-development environments due to a lack of authentication requirements and file placement restrictions.

GitLab assigned the flaw a maximum severity score of 10. Security firm watchTowr reported observing in-the-wild probes for vulnerable servers, noting that attackers could use the flaw to obtain credentials, secrets, and sensitive information. Hong Kong’s computer emergency response team also issued an advisory stating the vulnerability is being exploited.

In addition to the primary flaw, GitLab released a patch for a second vulnerability, CVE-2026-87719, which could allow attackers to obtain sensitive information from GitLab enterprise edition servers.