Vulnerabilities in Git-based development platforms

Security researchers and government agencies have identified multiple critical vulnerabilities and data exposures within Git-based development environments.

In late August, reports emerged regarding the exposure of 28,000 publicly reachable .git repositories due to web server misconfigurations. These repositories contained sensitive information, such as AWS, Stripe, and OpenAI API keys. Concurrently, a critical remote code execution vulnerability in Gitea (CVE-2026-60004) was identified as being actively exploited, with some instances involving cryptocurrency-mining payloads. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities catalog.

By mid-September, a new critical path traversal vulnerability was discovered in GitLab (CVE-2026-85706). This flaw, which carries a CVSS score of 10/10, allows unauthenticated users to read arbitrary files via the commits API. Exploitation attempts were observed shortly after public disclosure. While GitLab.com has been patched, approximately 20,000 self-managed instances remain vulnerable. CISA has mandated that federal agencies remediate this issue by September 14 to prevent the theft of source code and CI/CD secrets.