CVE-2026-87719Patch(gitlab / gitlab)

MEDIUMCVSS 9.9 · CRITICAL

Exploitation observed; activity peaked at 10 mentions and remains active

Immediate actions

Patch gitlab gitlab systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

gitlab CVEs Back to dashboard

5.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-502

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gitlab

Threat summary

Active exploitation appears in 6 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
24 mentions across 6 observed days

What's happening

Active exploitation reported across 6 signals
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 20 signals
Technical details provided in 21 signals
Disclosure: 2 classified signals
Peaked 5d ago at 10 mentions (2026-09-11); latest day: 2
24 total mentions across 6 days

Affected systems

Vendors

gitlab

Products

gitlab

Deep dive

Activity timeline24 mentions / 6d

Signal classification4 categories

Patch

1562.5%

Active Exploitation

625.0%

Disclosure

28.3%

General

14.2%

Referenced assets18 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-11	10	Active Exploitation1Patch9
2026-09-12	4	Active Exploitation1Disclosure1Patch2
2026-09-13	4	Active Exploitation2Patch2
2026-09-14	2	Disclosure1General1
2026-09-15	2	Active Exploitation2
2026-09-30	2	Patch2

Full discourse20 posts

elhacker.NET@elhackernet43d
Patch
GitLab pide a sus usuarios corregir una vulnerabilidad crítica de salto de directorio GitLab ha instado a sus usuarios a actualizar sus servidores inmediatamente para corregir dos vulnerabilidades críticas: una de salto de directorio (CVE-2026-85706) que permite leer archivos arbitrarios y otra de deserialización insegura (CVE-2026-87719) https://blog.elhacker.net/2026/09/gitlab-pide-sus-usuarios-corregir-una.html
Post summary
El texto informa sobre dos vulnerabilidades críticas en GitLab y destaca la recomendación de actualizar inmediatamente los servidores. No se mencionan PoCs, exploits funcionales ni explotación activa.
113046144.7K
142.5K followersView on X
CERT@certlv46d
Patch
‼️GitLab ir publicējis informāciju par divām kritiskām ievainojamībām - CVE-2026-85706 (CVSS 10.0) un CVE-2026-87719 (CVSS 9.9). Aicinām pēc iespējas ātrāk atjaunināt uz versijām 19.3.2, 19.2.6 vai 19.1.8. Vairāk infromācijas: https://www.cert.lv/lv/2026/09/kritiskas-ievainojamibas-gitlab-programmatura https://t.co/j17bEDf1Os
Post summary
GitLab announced two critical CVEs with CVSS scores of 10.0 and 9.9, advising users to upgrade to specific patched versions 19.3.2, 19.2.6, or 19.1.8. No PoC, exploit, or active exploitation details are mentioned.
040721.3K
5.7K followersView on X
kokumօtօ@__kokumoto46d
Patch
GitLabでCVSSスコア10の脆弱性が修正。CVE-2026-85706はリポジトリコミットエンドポイントにおけるアクセス制御の欠落で、無認証の攻撃者がサーバ上の任意ファイルを読み取れる。CVE-2026-87719（CVSSスコア9.9の安全でないデシリアライゼーション）等と併せ修正。 https://securityonline.info/gitlab-vulnerabilities-cve-2026-85706-cvss-10/
Post summary
The article announces that GitLab has fixed the high‑severity CVE‑2026‑85706, which allowed unauthenticated file reads, along with the related CVE‑2026‑87719 insecure deserialization flaw.
020731.3K
7.8K followersView on X
The CyberSec Guru@thecybersecguru45d
Patch
🚨 BREAKING: GITLAB CVSS 10.0 VULNERABILITY 🚨 GitLab has patched CVE-2026-85706, a MAXIMUM-SEVERITY CVSS 10.0 path traversal vulnerability that can allow an unauthenticated attacker to read arbitrary files from vulnerable self-managed GitLab servers. Read the full GitLab CVE-2026-85706 analysis → https://thecybersecguru.com/news/gitlab-cve-2026-85706-cvss-10-path-traversal/ That could expose: 🔴 Source code 🔴 Configuration files 🔴 Secrets & credentials 🔴 CI/CD infrastructure 🔴 Sensitive enterprise data And there’s more. GitLab also fixed CVE-2026-87719, a CVSS 9.9 insecure deserialization flaw affecting GitLab Enterprise Edition environments using Duo Chat. If you run self-managed GitLab, this is a PATCH-NOW situation. Affected releases include versions fixed in: ➡️ GitLab 19.3.2 ➡️ GitLab 19.2.6 ➡️ GitLab 19.1.8 I broke down CVE-2026-85706, the path traversal attack, CVE-2026-87719, affected versions, impact, and remediation. #GitLab #CVE202685706 #CVE202687719 #CyberSecurity #InfoSec #DevSecOps #Vulnerability #CVE #PathTraversal
Post summary
The tweet announces that GitLab has patched CVE-2026-85706 (a CVSS 10.0 path traversal flaw) and CVE-2026-87719 (a CVSS 9.9 insecure deserialization vulnerability). It highlights the impact, lists affected releases, and urges users to apply the patches immediately.
02052492
1.6K followersView on X
Checkmarx Zero@CheckmarxZero45d
Patch
Gitlab just released versions 19.3.2, 19.2.6, 19.1.8 that include security fixes for two critical CVEs: 🚨 CVE-2026-85706: A 10.0 Path Traversal in the repository commits API allowing unauthenticated users to read arbitrary files from Gitlab Server, affecting Community and Enterprise Editions versions from 18.7. 🚨 CVE-2026-87719: A 9.9 Insecure Deserialization allowing authenticated users with Duo Chat access to get Advanced Search instance configurations and sensitive credentials via a crafted GraphQL subscription argument, affecting only Enterprise Edition versions from 18.3. There are more CVEs being patched in this release, you can read about it here: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/?nav=19.1.8 If you're running your own 🦊 Gitlab installation, patch immediately.
Post summary
GitLab released patches for CVE-2026-85706 (path traversal) and CVE-2026-87719 (insecure deserialization) across various editions, advising users to apply the updates immediately to mitigate these critical vulnerabilities.
10030165
249 followersView on X
YourDailyCVE@YourDailyCVE45d
Patch
🚨 CVE-2026-85706 — GitLab commits API, unauth file read. CVSS 10.0. What broke: the repository commits API did not lock files to the repo and did not always require a login. Under the right conditions a stranger can read files off the GitLab host — configs, tokens, keys, whatever the GitLab process can open. Who should care: self-managed GitLab CE (Community Edition) or EE (Enterprise Edition) from 18.7 up to, but not including, 19.1.8 / 19.2.6 / 19.3.2. http://GitLab.com is already patched. Dedicated customers do nothing. If your source-of-truth repo server is on the internet, this is you. Impact: this is unauthenticated arbitrary file read — an attacker can pull files off the server they were never meant to see, "under certain conditions" per GitLab's own wording. Depending on what's reachable on a given deployment, that can include application configuration files, secret keys, authentication tokens, or credentials stored on disk. It doesn't hand over the whole server outright, but it can hand an attacker exactly the keys needed to go further. Status: GitLab has not said it is exploited. watchTowr is already seeing scans for exposed instances. Same pattern as past GitLab criticals: probe today, spray tomorrow. Not on CISA KEV yet. Fix today: upgrade to 19.3.2, 19.2.6, or 19.1.8. Same patch train has a second Critical for EE: CVE-2026-87719 (GraphQL deserialization). Take both. Can't patch: take the instance off the raw internet. Restrict /api/v4/ to trusted nets. Hunt logs for POSTs to /api/v4/projects/.../repository/commits/ with odd file.path values. Do this now: if you run self-managed GitLab, upgrade today and reply “patched.”Source: GitLab Critical Patch Release / BleepingComputer / watchTowr #GitLab
Post summary
CVE-2026-85706 is a critical unauthenticated file‑read flaw in GitLab’s commits API; patches (19.3.2, 19.2.6, 19.1.8) are available, and mitigation steps are advised, though no active exploitation has been reported yet.
10020195
36 followersView on X
Threat Landscape@LandscapeThreat43d
Active Exploitation
Internet-wide probing has begun against critical vulnerabilities in self-managed GitLab installations, increasing the likelihood of indiscriminate exploitation. - CVE-2026-85706 enables unauthenticated attackers to read arbitrary server files through a path-traversal flaw in the repository commit interface. - CVE-2026-87719 allows authenticated Enterprise Edition users with Duo Chat access to expose Advanced Search settings and stored passwords through command injection in a request. - WatchTowr observed probes targeting POST requests under the repository commits API with a file.path parameter and identified internet-exposed self-hosted servers as the highest-risk deployments. - CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog; administrators should patch and review relevant HTTP logs. VULNERABILITY CVE-2026-85706 CVE-2026-87719
Post summary
The passage reports that CVE-2026-85706 and CVE-2026-87719 are actively exploited in the wild, evidenced by internet‑wide probing and inclusion in CISA’s Known Exploited Vulnerabilities catalog, and urges admins to patch and monitor logs.
0002074
124 followersView on X
nksistemas@nksistemas26d
Patch
Alerta Crítica en GitLab 19.0.9 y 18.11.12: Parches de Seguridad Urgentes para CVE-2026-85706 y CVE-2026-87719 https://nksistemas.com/alerta-critica-en-gitlab-19-0-9-y-18-11-12-parches-de-seguridad-urgentes-para-cve-2026-85706-y-cve-2026-87719/
Post summary
The text alerts users about urgent security patches for GitLab versions 19.0.9 and 18.11.12 to fix critical vulnerabilities identified as CVE-2026-85706 and CVE-2026-87719.
01000158
6.2K followersView on X
Sprunky • The Source 👁️@sprunky_eth42d
Active Exploitation
🚨 Follow-up on CVE-2026-85706 🚨 A few operational details for defenders triaging: 🔴 Already exploited in the wild. CISA added it to KEV on 11 Sep, federal deadline 14 Sep. watchTowr saw probes within hours of the patch release. ⚠️ Same patch fixes CVE-2026-87719 (CVSS 9.9) — GraphQL deserialization in GitLab EE (Duo Chat). Can expose instance credentials. Don't skip it. 🛠️ Root cause: parser differential between Workhorse (Go) and Puma/Grape (Ruby). One encoded char (%63ommits) bypasses the proxy, still hits Rails. Auth runs after file read, exfil via Rack error echo. 🔎 Detection: POST /api/v4/projects/{id}/repository/commits/ with file.path query param. Variants: %63ommits, %72epository, commits/, commits.json. 📦 Public PoCs already do FD enumeration and tiered loot targeting — not just a simple file read. Stay safe.
Post summary
The post confirms CVE-2026-85706 is already being exploited in the wild (CISA KEV), shares technical details and detection guidance, and notes that a patch also resolves CVE-2026-87719.
0001098
6.6K followersView on X
The Daily Tech Feed@dailytechonx45d
Active Exploitation
GitLab just fixed a CVSS 10 file-read flaw (CVE-2026-85706) now under active exploit probes. This path-traversal issue in the repository commits API impacts public projects on CE/EE between versions 18.7-19.3 pre-patch. Also patched: a serious insecure deserialization bug (CVE-2026-87719) in EE. If you run self-hosted instances visible on the internet, upgrade to 19.1.8 / 19.2.6 / 19.3.2 immediately or lock down public access. Review your logs for POST requests to “/api/v4/projects/{id}/repository/commits/” with a “file.Path” parameter — attackers are already probing. #Security #GitLab #Vulnerability #Cybersecurity #GitLab #Security #Vulnerability #CVSS10 #Cybersecurity #DevSecOps https://thedailytechfeed.com/gitlab-patches-critical-cve-2026-85706-file-read-bug-under-active-exploit/
Post summary
GitLab flags that CVE‑2026‑85706, a CVSS‑10 file‑read flaw, is already being probed in the wild and urges users to upgrade or restrict access to mitigate the threat.
00010131
723 followersView on X
Autumn Good@autumn_good_3545d
Patch
🚨🚨🚨 CVE-2026-85706 - Path Traversal issue in repository commits API impacts GitLab CE/EE CVE-2026-87719 - Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8 https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/
Post summary
Two GitLab vulnerabilities—path traversal and insecure deserialization—are addressed with critical patch releases; the post includes patch versions and a documentation link.
00010501
7.1K followersView on X
zoomeyebot@zoomeyebot26d
Patch
🚨 GitLab EE Insecure Deserialization CVE-2026-87719 (CVSS 9.9) Fixed in Critical Patch Release Critical Vulnerability Alert! GitLab Enterprise Edition (EE) is affected by CVE-2026-87719. 🔍 Identify Targets via ZoomEye: Search Dork: app="GitLab" Exposure: 1.3m instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJHaXRMYWIi #Infosec #CyberSecurity #ZoomEye
Post summary
The post announces a critical GitLab EE vulnerability with a CVSS score of 9.9 and notes that it has been fixed in a critical patch release, providing a ZoomEye link to identify exposed instances.
0000044
25 followersView on X
hackerlogs@hackerlogs42d
Active Exploitation
@CISAgov's @gitlab KEV clock ran out. Self-managed still reads open. CVE-2026-85706 is CVSS 10.0 unauthenticated file read on the repository commits API. @gitlab patched 10 Sep (19.1.8 / 19.2.6 / 19.3.2). CISA listed it KEV on 11 Sep; federal due was 14 Sep with forensic triage. @BleepinComputer carried the in-the-wild warning. http://GitLab.com and Dedicated are already covered. Self-managed CE/EE from 18.7 below those builds is the remaining surface. Same train also ships CVE-2026-87719 (Duo Chat GraphQL, EE, not KEV). Not the July Hugging Face Artifactory path. Human-exploited Git host next to CI secrets. If you waited through the weekend, treat it as late: patch, then hunt readable secrets / deploy keys / unexpected users. Primary (GitLab patch): https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/ CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706 Write-up: https://hackerlogs.com/blog/gitlab-cve-2026-85706/
Post summary
The post describes CVE-2026-85706 as a CVSS 10.0 unauthenticated file read vulnerability in GitLab, confirms it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog due to in-the-wild attacks, and urges immediate patching and forensic investigation, particularly for self-managed instances. Patch details and technical specifics are included.
0000092
14 followersView on X
CERT-PY@CERTpy42d
General
⚠️ Vulnerabilidades en Plataformas de GitLab ❗ CVE-2026-87719 ❗ CVE-2026-85706 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-plataformas-de-gitlab/ https://t.co/uzzxL5FemW
Post summary
The text minimally alerts about two GitLab CVEs (CVE-2026-87719, CVE-2026-85706) and links to a CERT advisory, but provides no technical details, PoC, exploit, or patch information within the text itself.
00000223
6.7K followersView on X
Cybersecurity News DE@cybsecuritynews43d
Disclosure
#schwachstellen GitLab EE: Kritische Lücke CVE-2026-87719 legt Such-Konfigurationen und Zugangsdaten offen #cve202687719 #duochat #gitlab #gitlabee #graphql https://cybersecurity-news.de/gitlab-ee-cve-2026-87719-kritische-luecke
Post summary
Tweet announces critical GitLab EE vulnerability CVE-2026-87719, noting exposure of search configurations and credentials, and links to a news article for further details.
0000040
12 followersView on X
Breachrr@Breachrr43d
Active Exploitation
CISA added GitLab CVE-2026-85706 to the Known Exploited Vulnerabilities catalog on September 11. Federal civilian agencies have until September 14 to patch. The hole is in the repository commits API. GitLab says an unauthenticated caller can read arbitrary files on the server because the endpoint failed to confine paths and failed to enforce authentication. Self-managed CE and EE builds from 18.7 through the versions before 19.1.8, 19.2.6, and 19.3.2 are in scope. http://GitLab.com is already on the fixed release. watchTowr recorded probes against internet-exposed instances from 06:00 UTC on September 11, the day after the patch notes landed. Technical writeups of the request treat a public project on the instance as the usual prerequisite. A GitLab host is a secrets store. Configuration and logs on that box are the useful target of an arbitrary file read. Upgrade, then rotate tokens, runner secrets, and service credentials that lived on the server. The same release also fixes CVE-2026-87719 in GitLab EE. That one needs an authenticated Duo Chat user and can expose Advanced Search configuration and credentials through a crafted GraphQL subscription. Treat both as one change window.
Post summary
CISA added GitLab CVE-2026-85706 to the KEV catalog and probes were observed, indicating active exploitation; the text also provides technical details and patch guidance.
0000078
32 followersView on X
ADK Cyber@ADKCyber44d
Patch
GitLab EE: CVE-2026-87719 (CVSS 9.9) fixed in 19.1.8+, 19.2.6+, 19.3.2+. Check versions 18.3-19.1.7, 19.2-19.2.5, 19.3-19.3.1 and update. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/nfNC8guyCK
Post summary
The tweet announces CVE-2026-87719 with a CVSS 9.9 score and highlights the patch releases required to fix the issue.
0000047
95 followersView on X
LinuxGeek 🐧@NewsOfLinux44d
Patch
Affected: 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The same release carries a second critical, an insecure deserialization in the GraphQL subscription serializer (CVE-2026-87719, EE). https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/
Post summary
GitLab 19.3.2 release includes a patch for CVE‑2026‑87719, addressing an insecure deserialization flaw in the GraphQL subscription serializer. The patch is documented in the linked release notes.
0000041
125 followersView on X
sunil kumawat@Sunil_kumawat1744d
Active Exploitation
@CyberScoopNews Severity note: CVE-2026-85706 is Critical CVSS 10.0 (not just high). Companion Critical in the same train is CVE-2026-87719 (EE GraphQL deserialization). CISA KEV added Sep 11, due Sep 14.
Post summary
The tweet announces two critical CVEs with CVSS 10.0, highlights an active exploitation status via CISA KEV, but provides no PoC, exploit code, or patch information.
0000057
19 followersView on X
UNDERCODE TESTING@UndercodeUpdate45d
Disclosure
🚨 Critical GitLab EE Vulnerability #CVE-2026-87719: CVSS 99 Deserialization Flaw Exposes Advanced Search Credentials + Video -Prediction: 📈 2 Positive | 📉 2 Negative https://undercodetesting.com/critical-gitlab-ee-vulnerability-cve-2026-87719-cvss-99-deserialization-flaw-exposes-advanced-search-credentials-video/ Educational Purposes!
Post summary
The text announces a new critical deserialization vulnerability (CVE-2026-87719) in GitLab EE, noting its CVSS score and credential exposure, and refers to a video demonstration, but provides no patch, exploit code, or evidence of active exploitation.
0000059
737 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	gitlab	gitlab	-	-	-

Explore more

Back to dashboard gitlab CVEs gitlab vulnerabilities

What researchers are saying

CVE-2026-87719

kokumօtօ[verified]@__kokumotoPatch

The article announces that GitLab has fixed the high‑severity CVE‑2026‑85706, which allowed unauthenticated file reads, along with the related CVE‑2026‑87719 insecure deserialization flaw.

The CyberSec Guru[verified]@thecybersecguruPatch

The tweet announces that GitLab has patched CVE-2026-85706 (a CVSS 10.0 path traversal flaw) and CVE-2026-87719 (a CVSS 9.9 insecure deserialization vulnerability). It highlights the impact, lists affected releases, and urges users to apply the patches immediately.

Checkmarx Zero[verified]@CheckmarxZeroPatch

GitLab released patches for CVE-2026-85706 (path traversal) and CVE-2026-87719 (insecure deserialization) across various editions, advising users to apply the updates immediately to mitigate these critical vulnerabilities.

YourDailyCVE[verified]@YourDailyCVEPatch

CVE-2026-85706 is a critical unauthenticated file‑read flaw in GitLab’s commits API; patches (19.3.2, 19.2.6, 19.1.8) are available, and mitigation steps are advised, though no active exploitation has been reported yet.

Threat Landscape[verified]@LandscapeThreatActive Exploitation

The passage reports that CVE-2026-85706 and CVE-2026-87719 are actively exploited in the wild, evidenced by internet‑wide probing and inclusion in CISA’s Known Exploited Vulnerabilities catalog, and urges admins to patch and monitor logs.

Sprunky • The Source 👁️[verified]@sprunky_ethActive Exploitation

The post confirms CVE-2026-85706 is already being exploited in the wild (CISA KEV), shares technical details and detection guidance, and notes that a patch also resolves CVE-2026-87719.

The Daily Tech Feed[verified]@dailytechonxActive Exploitation

GitLab flags that CVE‑2026‑85706, a CVSS‑10 file‑read flaw, is already being probed in the wild and urges users to upgrade or restrict access to mitigate the threat.

zoomeyebot[verified]@zoomeyebotPatch

The post announces a critical GitLab EE vulnerability with a CVSS score of 9.9 and notes that it has been fixed in a critical patch release, providing a ZoomEye link to identify exposed instances.