[CLSTR]
API
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

7 clusters · 28 sources · 57 days · First seen · Last updated

Vulnerabilities in Git-based development platforms

Overview

Security researchers and government agencies have identified multiple critical vulnerabilities and data exposures within Git-based development environments. In late August, reports emerged regarding the exposure of 28,000 publicly reachable .git repositories due to web server misconfigurations. These repositories contained sensitive information, such as AWS, Stripe, and OpenAI API keys. Concurrently, a critical remote code execution vulnerability in Gitea (CVE-2026-60004) was identified as being actively exploited, with some instances involving cryptocurrency-mining payloads. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities catalog. By mid-September, focus shifted to a critical path traversal vulnerability in GitLab (CVE-2026-85706). Carrying a CVSS score of 10/10, the flaw allows unauthenticated users to read arbitrary files via the commits API. CISA added this flaw to its Known Exploited Vulnerabilities catalog, and security firm WatchTowr reported observing exploitation attempts. GitLab also released a patch for a second vulnerability, CVE-2026-87719, affecting Enterprise Edition servers. In late September, researchers at Aikido Security identified a flaw in GitLab’s ‘Email work item to this project’ feature involving non-expiring access tokens. GitLab reportedly classified this behavior as intended rather than a bug, opting to update documentation instead of issuing a patch. On October 2, GitLab released patches for a critical vulnerability in its AI Gateway (CVE-2026-90970). With a CVSS score of 9.9, the flaw could allow an authenticated user with access to the Duo Agent Platform to escape the prompt template sandbox and execute arbitrary commands on the AI Gateway host. While GitLab has deployed fixes to its own hosted gateways, organizations running self-hosted gateways must update to versions 19.2.4, 19.3.2, or 19.4.1 to mitigate the risk. As of October 2, CISA reported no evidence of active exploitation for this specific flaw.

Entities

GitLab · WatchTowr · CISA · Stripe · Intruder

Timeline

  1. [TECHNOLOGY] 6 sources
    GitLab releases critical security patches for remote code execution vulnerability

    GitLab issued critical patches for 12 vulnerabilities, including a remote code execution flaw (CVE-2026-110264) affecting many versions of its CE and EE editions.

  2. [TECHNOLOGY] 5 sources
    GitLab issues urgent patches for critical RCE vulnerability

    GitLab released urgent patches for a critical CVE-2026-97229 vulnerability with a CVSS score of 10.0, allowing unauthenticated remote code execution via its CI/CD regular expression compiler.

  3. [TECHNOLOGY] 6 sources
    GitLab patches critical AI Gateway vulnerability

    GitLab patched a critical 9.9 CVSS vulnerability (CVE-2026-90970) in its AI Gateway that allows authenticated Duo users to execute arbitrary commands on self-hosted systems.

  4. [TECHNOLOGY] 2 sources
    GitLab security flaw allows code injection via issue email addresses

    Aikido Security discovered that GitLab's issue-creation email addresses contain account-wide tokens, allowing attackers to push code and run CI/CD jobs by impersonating users via unverified emails.

  5. [TECHNOLOGY] 4 sources
    GitLab critical vulnerability exploited by malicious actors

    CISA has warned of active exploitation of a critical GitLab vulnerability (CVE-2026-85706) that allows unauthenticated access to sensitive files and credentials.

  6. [TECHNOLOGY] 4 sources
    GitLab vulnerability exploited shortly after disclosure

    A critical GitLab vulnerability (CVE-2026-85706) with a CVSS score of 10 is seeing active exploitation, allowing unauthenticated attackers to read arbitrary files from servers.

  7. [TECHNOLOGY] 5 sources
    Git repositories face massive credential exposure and critical Gitea vulnerability

    Researchers found 28,000 exposed Git repositories containing sensitive credentials, while a critical RCE vulnerability in Gitea is being actively exploited in the wild.

Sources

all-about-security.de · alobbs.com · bitnewsbot.com · businesstechweekly.com · cybernoz.com · cybersecuritydive.com · cybersecuritynews.com · dev.to · devops.com · drweb.de · emarketerz.fr · flagthis.com · forkast.news · gamemag.it · gigazine.net · hackernews.com · infoq.com · invitehealth.substack.com · it-boltwise.de · itnerd.blog · linode.com · linuxsecurity.com · securityaffairs.co · socprime.com · tekniikkatalous.fi · thehackernews.com · venceremos.it · world-today-news.com

This summary has been updated 5 times: see revision history