Critical GitLab Vulnerabilities Exposed: Deep Dive into the CVSS 10.0 Path Traversal (CVE-2026-85706) & GraphQL Exploits

GitLab has issued an out-of-band security release to fix a maximum-severity path traversal vulnerability in self-managed enterprise environments. Disclosed on September 11, 2026, the flaw, tracked as CVE-2026-85706, carries a perfect CVSS v3.1 score of 10.0 and lets unauthenticated attackers pull sensitive configuration files, proprietary source code, and database credentials off vulnerable servers.

Alongside it, GitLab patched a second high-severity insecure deserialization vulnerability, CVE-2026-87719, affecting Enterprise Edition instances that use the Duo Chat AI assistant. GitLab says it powers DevSecOps pipelines for more than 30 million registered users and over half of the Fortune 100, including Nvidia, Airbus, and Goldman Sachs. That scale is why delaying these updates carries real supply chain risk.

The Anatomy of CVE-2026-85706: A CVSS 10.0 Path Traversal

A security researcher using the handle s3ntago found CVE-2026-85706 through GitLab’s HackerOne bug bounty program. The flaw sits in GitLab’s repository commits API, an endpoint that CI/CD pipelines, automation scripts, and third-party integrations rely on to interact with version control data.

Here’s how the API normally works: when a call comes in to retrieve commit data or file diffs, GitLab’s Ruby on Rails backend passes the requested file path to Gitaly, its custom RPC wrapper around Git. Sanitization routines are supposed to keep that path confined to the specific repository’s directory tree. In the affected versions, the commits API fails to strip directory traversal sequences, such as ../ or their URL-encoded variants. According to GitLab’s security advisory, the vulnerability stems from a combination of “improper path confinement” and “missing authentication enforcement.” Because the authentication check was bypassed under specific, undocumented conditions, an attacker needs no valid credentials, private tokens, or prior user interaction to trigger it.

The Exploit Chain: How the Arbitrary File Read Works

An unauthenticated attacker can craft an HTTP GET request to the commits API that injects path traversal characters, breaking out of the repository sandbox and reaching the host’s file system. Some researchers on X have called the bug unusual, noting that GitLab has been audited so many times that finding an unauthenticated, maximum-severity bypass of this kind is rare and points to a genuinely complex logic flaw.

A theoretical proof-of-concept would involve manipulating the path or file reference parameter in the API request, aiming at files like /etc/passwd, /opt/gitlab/embedded/service/gitlab-rails/config/secrets.yml, or /etc/gitlab/gitlab.rb. In a similar GitLab path traversal flaw, CVE-2023-2825, attackers used these same techniques to read secrets.yml, which holds the cryptographic keys GitLab uses to encrypt database columns and session cookies.

From File Read to Full Infrastructure Takeover

Reading arbitrary files off a self-managed GitLab server isn’t just a data leak, it’s the first step toward a full infrastructure compromise. If an attacker exfiltrates the gitlab.rb configuration file or the database credentials in secrets.yml, they get immediate access to the underlying PostgreSQL database. From there they can escalate to GitLab administrator, inject malicious code into CI/CD pipelines (enabling software supply chain attacks), and pivot into the broader corporate network. For any organization storing proprietary software, AI models, or infrastructure-as-code templates on an affected server, this flaw is a direct path to intellectual property theft.

CVE-2026-87719: GraphQL Deserialization and the Duo Chat Threat Vector

CVE-2026-85706 is getting most of the attention because it’s unauthenticated, but GitLab Enterprise Edition administrators need to move just as fast on CVE-2026-87719, a critical insecure deserialization flaw with a CVSS score of 9.9. It sits in the GraphQL subscription serializer and specifically targets environments running GitLab Duo Chat, the platform’s generative AI coding assistant. GraphQL subscriptions rely on persistent WebSocket connections, typically managed by ActionCable and backed by Redis, to stream real-time data like AI code suggestions and chat responses back to a user’s IDE or browser.

An authenticated attacker can submit a specially crafted GraphQL subscription argument that bypasses GitLab’s serialization controls. In Ruby on Rails, deserialization vulnerabilities happen when an application takes untrusted input and converts it back into a Ruby object without strict whitelisting. By injecting a malicious object reference into the subscription channel arguments, the attacker triggers a server-side object lookup, letting them query internal memory states or database models that should be off-limits.

Stealing Advanced Search Configurations and AI Credentials

The main target here is Advanced Search configuration data and backend credentials. GitLab’s Advanced Search relies on external indexing engines like Elasticsearch or OpenSearch for codebase-wide search, and the credentials that authenticate GitLab against those clusters are highly sensitive. By manipulating the GraphQL subscription serializer, an attacker with basic Duo Chat access can force the backend to dump those credentials, giving them unrestricted access to the organization’s entire indexed codebase, internal wikis, and issue trackers, regardless of repository-level permissions.

A History of Preventable Path Traversal Flaws

Seeing another maximum-severity path traversal flaw in GitLab is frustrating for anyone who follows this space. Directory traversal, categorized under CWE-22, has been labeled an “unforgivable” vulnerability class by MITRE since 2007. In May 2024, CISA and the FBI issued a joint Secure by Design alert urging software makers to eliminate these vulnerabilities before shipping products, calling them easily preventable defects that have plagued the industry for decades.

GitLab has had path confinement problems before. In May 2023, the company patched CVE-2023-2825, another critical arbitrary file read vulnerability that was quickly weaponized by ransomware gangs and APT groups to steal proprietary source code and OAuth tokens from unpatched servers. This patch also follows a rough year for GitLab security. Back in January, the platform fixed CVE-2026-0723, a high-severity two-factor authentication bypass that let attackers who knew a target’s account ID forge device responses and get around MFA entirely.

Remediation: Patching Your GitLab Instance

GitLab has released fixes in Community Edition and Enterprise Edition versions 19.3.2, 19.2.6, and 19.1.8. The company recommends upgrading self-managed installations immediately, since automated scanners typically start probing for newly disclosed flaws within hours of disclosure.

Impacted Versions for CVE-2026-85706 (Path Traversal)

• GitLab CE/EE versions 18.7 prior to 19.1.8
• GitLab CE/EE versions 19.2 prior to 19.2.6
• GitLab CE/EE versions 19.3 prior to 19.3.2

Impacted Versions for CVE-2026-87719 (GraphQL Deserialization)

• GitLab EE versions 18.3 prior to 19.1.8
• GitLab EE versions 19.2 prior to 19.2.6
• GitLab EE versions 19.3 prior to 19.3.2

Deployment Specifics

GitLab.com SaaS users don’t need to do anything, since the cloud infrastructure already runs the patched versions. GitLab Dedicated customers are covered by their managed service agreements. Administrators of self-managed instances, whether on Omnibus, Helm, or Source installations, have to trigger the upgrade manually. Security teams should also check web server access logs for anomalous API requests with directory traversal sequences targeting the /api/v4/projects/ endpoints, and watch for unusual WebSocket connection spikes on GraphQL subscription channels.

What This Means for DevSecOps Teams

CVE-2026-85706 and CVE-2026-87719 show that even mature, widely audited DevSecOps platforms remain vulnerable to basic web application flaws like path traversal and insecure deserialization. Patch management, network segmentation, and WAF rules that filter anomalous API payloads are the baseline defenses here, not optional extras. Administrators running self-managed GitLab should apply this patch now to protect their source code, infrastructure credentials, and CI/CD pipeline.