DEV Community

Anoymask
Anoymask

Posted on Edited on

GitLab CVE-2026-85706: Active Scanning Targeting Pre-Authentication File Read

#security #threatintel

1. Basic Information

2. Executive Summary

The pre-authentication arbitrary file read vulnerability (CVE-2026-85706) in self-managed GitLab has been added to CISA KEV. Organizations must apply security patches and investigate potential sensitive data leaks and subsequent credential usage during the exposure window.

3. Attack Flow

1. File Read via Commit API

  1. An attacker scans for self-managed GitLab instances accessible from the external network.
  2. The attacker sends an unauthenticated request to the Commit API containing a file.path parameter with an out-of-scope path.
  3. If the vulnerability conditions are met, the attacker can read file contents from the GitLab server.
  4. Inference: If the read is successful, sensitive information such as tokens included in settings or logs may be obtained.
  5. Inference: If valid credentials are acquired, unauthorized access to GitLab or integrated services may occur. Publicly available scanning intelligence does not confirm successful exploitation beyond the scan itself.

4. Attacker Position and Execution Location

  • An unauthenticated external attacker with network reachability to GitLab.
  • Inference: After obtaining sensitive information, if valid credentials remain, follow-up actions mimicking legitimate users or services are possible.

5. Visibility for Victims and Administrators

Victims

  • The attack requires no user interaction or UI rendering, making it difficult to detect through normal GitLab usage.

Administrators

  • Unusual unauthenticated POST requests to the Commit API and file.path parameters.
  • Inference: If sensitive information is obtained, token usage from unknown sources, Runner registrations, and project enumerations become targets for follow-up investigation.

6. Success and Failure Conditions

Success Conditions

  • The attacker can reach a vulnerable self-managed GitLab instance and meet the specific conditions outlined by the product.
  • Inference: For file reads to lead to authentication abuse, the readable files must contain valid credentials.

Failure Conditions and Risk Mitigation

  • Update to patched versions 19.1.8, 19.2.6, 19.3.2, or later to prevent file reads via this vulnerability.
  • Inference: Restricting API access origins via VPN or allowlists can prevent attacks from unauthorized sources.
  • Inference: Limiting file permissions and the scope of stored sensitive data can limit potential damage if a file read succeeds. Credential revocation serves as a separate measure to stop subsequent exploitation.

7. Impact of Successful Exploitation

  • If conditions are met, files on the GitLab server can be read prior to authentication.
  • Inference: Depending on the privileges of the leaked credentials, unauthorized access to repositories, CI/CD variables, artifacts, and Runners may occur.
  • Inference: If integrated service credentials are also obtained, the impact could spread to cloud environments and downstream development or deployment pipelines.

8. Observable Logs

Inference: Depending on logging configurations, the following records can be used for internal investigations:

Email

  • User-facing emails are not required for this attack vector.

Proxy, SWG, and DNS

  • Inference: Reverse proxies or application logs that capture request bodies can reveal unauthenticated POST requests to the Commit API and path traversal patterns. URLs alone do not show the file.path value in the request body.

Endpoints and EDR

  • Inference: If file access is logged, abnormal settings or log reads by the GitLab process can be identified. Without logs, past file reads may be impossible to confirm post-incident.

Authentication and IdP

  • Inference: Review token usage, Runner registrations, and administrative actions on GitLab. External IdP logs alone may not track internal GitLab authentication.

SaaS and Cloud

  • Inference: Depending on logging settings, correlate GitLab audit logs with linked cloud operation histories. The availability of records for individual operations, such as viewing CI/CD variables, depends on configuration.

Network

  • Inference: Check response sizes and subsequent traffic for unauthenticated requests. Large responses alone do not confirm file exfiltration.

9. Attack Success Determination

Scope Confirmed via Public Information

  • Attack attempts observed (success unconfirmed): Public Intelligence: Reports based on watchTowr data indicate scanning requests have been observed, but these observations do not confirm successful file reads. Separately, active exploitation of this CVE has been confirmed via CISA KEV inclusion. The number of successful individual compromises and subsequent actions remain unpublicized.

Internal Determination Criteria

  • Information theft or session compromise confirmed: Criteria: If there is evidence that out-of-scope file contents were returned in the response, it is judged as a data leak of those files. Unconfirmed in public intelligence. File reads must not be equated with OS-level code execution.
  • Malware execution or successful authentication confirmed: Criteria: If there is evidence of successful authentication using acquired credentials, it is classified at this stage. Unconfirmed in public intelligence.
  • Subsequent compromise confirmed: Criteria: When unauthorized operations against Runners, cloud environments, or downstream CI/CD pipelines using stolen credentials are confirmed. Unconfirmed in public intelligence.

10. Investigation Playbook

Inference: The following is an internal investigation procedure based on public intelligence.

Investigation Starting Point

  • Unauthenticated POST requests to the Commit API, path traversal strings, or known scanning sources post-disclosure.

Initial Verification

  • Check GitLab version, exposure scope, patch time, earliest abnormal request, and response sizes.
  • Preserve Web, Workhorse, Rails, audit, OS, IdP, and Runner logs.

Endpoints and Servers

  • Audit GitLab servers for abnormal read access to settings, secrets, and log files, and check web worker child processes and modified files.

Authentication and Cloud

  • Check the usage origins of all access tokens, deploy keys, Runner tokens, OIDC/SAML configurations, container registries, and cloud authentication keys.

Subsequent Operations

  • Chronologically track repository cloning, CI variable viewing, Runner additions, pipeline modifications, artifact retrieval, and cloud operations.

Containment

  • Apply updates or network isolation, and revoke and reissue access tokens, Runner credentials, and external service authentication keys that may have been leaked, following issuer procedures.
  • Do not rotate the GitLab database encryption key using the same method as access tokens. Official Linux package instructions exclude the gitlab_rails key within gitlab-secrets.json from simple rotation. If a leak is suspected, verify backups and decryption feasibility, and determine a recovery plan including product support.
  • Invalidate suspicious Runners and sessions, and verify the integrity of critical repositories and artifacts.

Classification of Findings

  • Distinguish between scanning, successful file read, sensitive data acquisition, successful authentication, and supply chain/cloud lateral movement.

11. Defense and Detection Ideas

Inference: The following are detection and mitigation ideas based on public intelligence.

Single Events

  • Inference: Unauthenticated Commit API requests containing ../, multiple instances, or URL-encoded variations.
  • Inference: New Runner registrations from unknown management sources.

Time-Series Correlation

  • Inference: Correlate unauthenticated API requests -> large responses -> token usage from new sources -> repository/CI variable retrieval.

Threat Hunting

  • Inference: Look back across the exposure window of vulnerable versions, including times prior to September 11, 2026, 06:00 UTC, when scanning was first reported. Examine target API requests/responses and changes in token usage sources.

Log Shortages and Limitations

  • Without HTTP bodies, response sizes, token IDs, and OS file access logs, confirming success is difficult.

Priority Mitigations

  • Inference: Prioritize updates and reducing public exposure. Proceed with revoking potentially leaked tokens and integration credentials, and verifying the integrity of Runners and artifacts. Handle database encryption keys separately according to official instructions.

12. Facts, Inference, and Hypothesis

Facts

  • CVE-2026-85706 stems from improper path restriction and missing authentication enforcement in the Commit API, allowing unauthenticated arbitrary file reads under certain conditions.
  • Affected scope includes GitLab CE/EE from 18.7 before 19.1.8, 19.2 series before 19.2.6, and 19.3 series before 19.3.2.
  • GitLab patched these in versions 19.1.8, 19.2.6, and 19.3.2. GitLab.com is updated, and GitLab Dedicated requires no action.
  • SecurityWeek reported that watchTowr observed active scanning starting September 11, 2026, at 06:00 UTC. watchTowr public disclosures do not confirm successful file reads or subsequent compromises in victim environments.
  • In the same patch release, GitLab also fixed CVE-2026-87719, an insecure deserialization vulnerability in the GraphQL subscription serializer exploitable by authenticated users with Duo Chat permissions.
  • CISA added CVE-2026-85706 to its KEV catalog on September 11, 2026, setting a remediation deadline of September 14 for U.S. federal agencies and requiring forensic investigations. Ransomware usage status is unknown.

Inference

  • If GitLab settings or logs are read, subsequent compromises using Runner tokens, repository credentials, OIDC/SAML configurations, and external service keys may occur.
  • Applying patches alone does not invalidate sensitive data read during the exposure window.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Additional Investigations."

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (Confidence: High): Exploiting internet-reachable GitLab APIs prior to authentication.
  • T1552.001 Unsecured Credentials: Credentials In Files (Confidence: Medium): Inference: Potential searching for credentials within settings and logs via arbitrary file reads.
  • T1078 Valid Accounts (Confidence: Low): Inference: Subsequent access using stolen tokens or credentials is assumed, but success remains unconfirmed in public intelligence.

14. Unknowns and Additional Investigations

  • Complete URIs, payloads, and source IOCs of exploitation requests.
  • The number of organizations that progressed from active scanning to file retrieval and credential abuse.
  • Details regarding the specific conditions required to trigger the vulnerability across various GitLab configurations.
  • Whether scanning requests successfully resulted in sensitive data acquisition and subsequent authentication requires investigation via target organization logs and response records.

15. Impact on SOCs and Organizations

Organizations consolidating source code or CI/CD credentials on self-managed GitLab instances face potential risks where file read impacts extend to integrated services. Identify public assets, apply updates, and correlate API requests and credential usage during the period when vulnerable versions were exposed. Do not treat the observed scanning timestamp as the lower bound for when attacks began.

16. Summary by Role

  • SOC: Correlate unauthenticated POST requests to the Commit API, path traversal patterns, and subsequent token usage, Runner registration, and repository retrieval.
  • Administrators: Update to versions 19.1.8, 19.2.6, 19.3.2, or later. Revoke and reissue potentially leaked tokens and integration credentials, and determine database encryption key handling separately without simple rotation.
  • Users: No user action is required. Report unknown token notifications or suspicious pipeline and repository modifications.

Top comments (1)

Some comments may only be visible to logged-in visitors. Sign in to view all comments.