GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab has released an emergency security update to address a maximum-severity path traversal vulnerability identified as CVE-2026-85706. This critical flaw involves the Commits-API and allows an attacker to access every file on a server using a single HTTP request. According to reports from CyberPress and other outlets, the vulnerability enables arbitrary file reads, the theft of credentials, and remote code execution. The severity of the flaw is reflected in its CVSS score of 10, the highest possible rating for security vulnerabilities. Coverage of the event is widespread across technical and security news platforms. BleepingComputer reports that GitLab is urgently calling on its users to apply the necessary patches.

The Hacker News and CyberScoop emphasize that the flaw began drawing internet-wide probes almost immediately following its disclosure. Forkast.news specifically highlights the speed of the threat, stating that active exploitation began within hours of the vulnerability becoming known. Field Effect also notes the commencement of these internet-wide probing activities as GitLab worked to fix the flaw. This situation is critical because GitLab servers often host sensitive source code and infrastructure secrets. The ability for an external actor to perform arbitrary file reads via a path traversal flaw in the Commits-API creates a direct path to credential theft. As noted by watchTowr in their rapid reaction analysis, the technical nature of the flaw allows for significant system compromise.

Because the vulnerability allows for remote code execution, the stakes involve the total takeover of affected server environments, necessitating the emergency nature of the patch. Future developments will depend on the rate of user adoption for the emergency security update. While GitLab has already issued the fix, the ongoing internet-wide probes reported by CyberScoop and The Hacker News suggest that attackers are actively seeking unpatched systems. WatchTowr and other security monitors will likely continue tracking the activity surrounding CVE-2026-85706 to determine the scale of successful exploitations. Users are expected to prioritize the update to prevent the credential theft and remote code execution capabilities identified in the coverage.