GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8

GitLab confirms that CVE-2026-85706, a critical path-traversal flaw in the repository-commits API, was exploited in the wild. Under certain conditions, an unauthenticated attacker could read arbitrary files from a self-managed GitLab server; the CVSS score is 10.0. A public project is the stated precondition.

Affected installations should move to 19.3.2, 19.2.6, or 19.1.8, or to the September 23 backports 19.0.9 and 18.11.12. GitLab says its hosted infrastructure is already patched and links three detections for self-managed defenders. The accompanying reporting adds useful response context: watchTowr observed probes after disclosure and recommends hunting relevant API requests, while security practitioners warn that patching alone cannot revoke any secrets already copied—rotate exposed CI/CD credentials too. InfoQ has no reader-comment thread; these are attributed defensive recommendations, not a comment-section consensus.

• InfoQ report and cited response guidance
• CISA KEV entry