GitLab Issues Emergency Security Update For Maximum-Severity Vulnerability
GitLab has released an emergency security update to address a maximum-severity path traversal vulnerability, CVE-2026-85706. The flaw allows unauthenticated remote attackers to access arbitrary files on self-managed servers, prompting urgent calls for administrators to patch their systems.
Why it matters
As a critical infrastructure tool for software development, a vulnerability of this magnitude poses a significant risk to corporate security and intellectual property.
GitLab is urging organisations to immediately update self-managed installations after fixing a maximum-severity path traversal vulnerability that could allow an unauthenticated remote attacker to read arbitrary files stored on the underlying server.
The vulnerability, tracked as CVE-2026-85706, has received the highest possible CVSS severity score of 10.0. It affects both GitLab Community Edition and Enterprise Edition across several recent release branches.
GitLab addressed the flaw with the release of GitLab 19.3.2, 19.2.6 and 19.1.8 . The company strongly recommended that administrators running an affected self-managed deployment upgrade to one of the patched versions as soon as possible.
The warning is particularly significant because GitLab installations frequently contain far more than source code. Depending on how an instance is configured, the surrounding environment may also hold authentication secrets, deployment credentials, CI/CD variables, infrastructure configuration, access tokens and other information capable of giving an attacker a route into downstream systems.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in