CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild

What it is

GitLab's September 10, 2026 critical patch release for CE/EE, addressed by Rapid7's analysis. The headline fix, CVE-2026-85706 (CVSS 10.0, CWE-22 path traversal in the repository commits API), is already covered in the catalog summary. What the summary omits is the deployment and remediation mechanics engineers need to actually execute the fix.

Preconditions / Affected

All self-managed deployment types are affected: Omnibus, source-code installs, and Helm chart deployments. GitLab.com is already patched, and GitLab Dedicated customers need take no action — only self-managed CE/EE is exposed.

What to do

• Upgrade self-managed instances to a fixed version immediately, outside normal patch cycles.
• The update includes database migrations. Single-node installations will experience downtime during migration; multi-node deployments should use GitLab's zero-downtime upgrade procedure.
• Of the fixed releases, only version 19.3.2 includes post-deployment migrations — relevant for upgrade planning/sequencing on multi-node setups.
• Rapid7 InsightVM/Nexpose/Exposure Command customers can check exposure to CVE-2026-85706 via a vulnerability check in the September 15 content release.
• Organizations subject to CISA BOD 26-04 must follow the forensic triage requirements tied to this KEV entry, not just patch-and-move-on.

flowchart TD
    A[Self-managed GitLab CE/EE] --> B{Deployment type?}
    B -->|Single-node| C[Upgrade with downtime during DB migration]
    B -->|Multi-node| D[Zero-downtime upgrade procedure]
    C --> E{Target version 19.3.2?}
    D --> E
    E -->|Yes| F[Post-deployment migrations also required]
    E -->|No| G[Standard migration only]

Caveats

At time of publication, only CVE-2026-85706 is confirmed exploited in the wild — the deserialization bug (CVE-2026-87719) and the other 17 fixed vulnerabilities are not. Rapid7's detection content for CVE-2026-85706 was not yet live at publication (scheduled for the September 15 content release).