GitLab patches maximum-severity file-read flaw as probes hit exposed servers

GitLab released patches for a maximum-severity path traversal flaw in its repository commits API that lets an unauthenticated attacker read arbitrary files from a GitLab server under certain conditions, the company said. The vulnerability, tracked as CVE-2026-85706 with a CVSS score of 10.0, stems from improper path confinement and missing authentication enforcement in that API. GitLab also patched a critical insecure deserialization bug in its Enterprise Edition that could expose instance configurations and credentials. Security firm watchTowr said it observed active in-the-wild probes against the flaw beginning the morning of September 11, 2026, and warned that mass exploitation is likely. Organizations running internet-exposed self-managed GitLab instances are urged to patch or restrict public access.