[REVISION HISTORY]

Vulnerabilities in Git-based development platforms

5 recorded revisions of this situation.

What changed

2026-10-03 13:04 UTC → 2026-10-13 10:12 UTC · added ~~removed~~

Security researchers and government agencies have identified multiple critical vulnerabilities and data exposures within Git-based development environments. In late August, reports emerged regarding the exposure of 28,000 publicly reachable .git repositories due to web server misconfigurations. These repositories contained sensitive information, such as AWS, Stripe, and OpenAI API keys. Concurrently, a critical remote code execution vulnerability in Gitea (CVE-2026-60004) was identified as being actively exploited, with some instances involving cryptocurrency-mining payloads. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities catalog. By mid-September, focus shifted to a critical path traversal vulnerability in GitLab (CVE-2026-85706). Carrying a CVSS score of 10/10, the flaw allows unauthenticated users to read arbitrary files via the commits API. CISA added this flaw to its Known Exploited Vulnerabilities catalog, and security firm WatchTowr reported observing exploitation attempts. GitLab also released a patch for a second vulnerability, CVE-2026-87719, affecting Enterprise Edition servers. In late September, researchers at Aikido Security identified a flaw in GitLab’s ‘Email work item to this project’ feature involving non-expiring access tokens. GitLab reportedly classified this behavior as intended rather than a bug, opting to update documentation instead of issuing a patch. On October 2, GitLab released patches for a critical vulnerability in its AI Gateway (CVE-2026-90970). With a CVSS score of 9.9, the flaw could allow an authenticated user with access to the Duo Agent Platform to escape the prompt template sandbox and execute arbitrary commands on the AI Gateway host. While GitLab has deployed fixes to its own hosted gateways, organizations running self-hosted gateways must update to versions 19.2.4, 19.3.2, or 19.4.1 to mitigate the risk. As of October 2, CISA reported no evidence of active exploitation for this specific flaw.

Versions

Select a version to see what changed compared to the one before it.