# Vulnerabilities in Git-based development platforms > Live situation record from CLSTR: https://clstr.news/situations/vulnerabilities-in-git-based-development-platforms > Updated: 2026-09-11T20:15:02.000Z. Sources: 9. Developments: 2. Security researchers and government agencies have identified multiple critical vulnerabilities and data exposures within Git-based development environments. In late August, reports emerged regarding the exposure of 28,000 publicly reachable .git repositories due to web server misconfigurations. These repositories contained sensitive information, such as AWS, Stripe, and OpenAI API keys. Concurrently, a critical remote code execution vulnerability in Gitea (CVE-2026-60004) was identified as being actively exploited, with some instances involving cryptocurrency-mining payloads. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities catalog. By mid-September, a new critical path traversal vulnerability was discovered in GitLab (CVE-2026-85706). This flaw, which carries a CVSS score of 10/10, allows unauthenticated users to read arbitrary files via the commits API. Exploitation attempts were observed shortly after public disclosure. While GitLab.com has been patched, approximately 20,000 self-managed instances remain vulnerable. CISA has mandated that federal agencies remediate this issue by September 14 to prevent the theft of source code and CI/CD secrets. ## Timeline ### 2026-09-11: GitLab vulnerability exploited shortly after disclosure A critical GitLab vulnerability (CVE-2026-85706) with a CVSS score of 10 is seeing active exploitation, allowing unauthenticated attackers to read arbitrary files from servers. 4 sources. https://clstr.news/cluster/gitlab-vulnerability-exploited-shortly-after-disclosure ### 2026-08-26: Git repositories face massive credential exposure and critical Gitea vulnerability Researchers found 28,000 exposed Git repositories containing sensitive credentials, while a critical RCE vulnerability in Gitea is being actively exploited in the wild. 5 sources. https://clstr.news/cluster/git-repositories-face-massive-credential-exposure-and-critical-gitea-vulnerability --- Cite as: Vulnerabilities in Git-based development platforms. CLSTR, https://clstr.news/situations/vulnerabilities-in-git-based-development-platforms