Attackers are exploiting a critical GitLab vulnerability to steal sensitive data from unpatched servers. Researchers have found 12 public exploit repositories, while around 13,700 exposed systems may remain vulnerable.
Attackers Exploit Critical GitLab Flaw
The vulnerability, tracked as CVE-2026-85706, affects GitLab Community Edition and Enterprise Edition. It carries the maximum severity rating.
Censys discovered at least 12 separate public repositories containing exploit code for the flaw. Meanwhile, threat actors are actively targeting internet-accessible GitLab instances.
The US Cybersecurity and Infrastructure Security Agency confirmed the active exploitation. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on September 11.
The agency then gave federal organisations three days to apply the required security measures.
GitLab provides a self-hosted platform for software development, security and IT operations. According to a regulatory filing, it serves more than 50 million registered users. Half of the Fortune 100 companies also use the platform.
Path Traversal Bug Exposes Sensitive Files
CVE-2026-85706 is a path traversal vulnerability. Under certain conditions, an unauthenticated attacker can exploit it to read arbitrary files from a vulnerable server.
Public exploit code demonstrates how attackers can access the gitlab-secrets.json file. This file contains keys that GitLab uses to encrypt secrets stored on the platform.
Those secrets may include CI/CD variables, deploy keys and integration tokens. Development pipelines rely on such credentials to connect with other services.
As a result, attackers could gain access to cloud accounts, container registries and source code repositories. They may then use the stolen credentials to launch a wider software supply chain attack.
Organisations often treat GitLab as both a development workshop and a secure vault. Instances can contain proprietary source code, automation scripts, security policies and other sensitive internal resources.
Therefore, unauthorised access can create risks far beyond the initial GitLab server.
Thousands of Servers Remain Vulnerable
Censys identified 86,231 internet-exposed hosts running GitLab. These servers corresponded to 208,186 individual web properties.
China had the largest number of exposed hosts, with 19,435 systems. The United States followed with 13,242, while Germany had 12,249.
Researchers also counted 8,639 exposed hosts in Russia and 5,062 in France. Other countries accounted for the remaining systems.
However, exposure alone does not mean that every server remains vulnerable. Data from the Shadowserver Foundation indicates that at least 13,700 exposed systems still lack protection against CVE-2026-85706.
The United States reportedly hosts the largest share of these vulnerable servers.
Organisations Should Rotate Stored Credentials
Censys warned organisations to treat credentials stored on vulnerable internet-facing instances as potentially compromised.
Administrators should immediately rotate CI/CD secrets, deploy keys and integration tokens. They should also investigate their GitLab environments for evidence of unauthorised access.
This review should extend to connected cloud platforms, repositories and container registries. Attackers may use stolen credentials after administrators patch the original GitLab server.
Consequently, installing an update alone may not remove the wider risk. Organisations must also invalidate exposed secrets and examine connected services for suspicious activity.
GitLab Releases Critical Security Updates
GitLab addressed CVE-2026-85706 in a security release that fixed 18 vulnerabilities. The update included patches for two critical security flaws.
The company strongly recommends upgrading all self-managed installations to one of the latest fixed versions:
- GitLab 19.3.2
- GitLab 19.2.6
- GitLab 19.1.8
This is the second critical GitLab vulnerability affecting unauthenticated users in less than one month.
GitLab disclosed a separate critical GraphQL flaw on August 17. Attackers began exploiting it less than 24 hours later to modify or delete public projects and user data.
The latest GitLab vulnerability again demonstrates how quickly attackers weaponise newly disclosed flaws. Administrators should patch immediately, rotate exposed credentials and investigate every affected system.
0 responses to “GitLab Vulnerability Exposes Secrets on Thousands of Servers”