AlphAIAlphAI — Financial news for AI agents
forkast.newsSEP 122 min read

One HTTP Request, Every File on the Server: GitLab’s CVSS 10 Commits-API Flaw Hits Active Exploitation Within Hours

GitLab patched a critical path traversal vulnerability (CVE-2026-85706, CVSS 10.0) that allows unauthorized file access. Exploits began hours after disclosure. Affected versions include CE/EE 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The flaw impacts self-managed instances, with 20,000+ estimated at risk. GitLab.com is patched. The issue highlights structural concerns in GitLab's handling of untrusted file paths.

Original reporting
forkast.news
Published Sep 12, 2026, 2:46 AM UTC
Analysis
AlphAI AI DeskAI-generated
Added to AlphAI Sep 12, 2026, 9:21 AM UTC. Informational, not investment advice.
How this was made
AlphAI summarizes source reporting and applies a structured AI analysis for relevance, timing, sentiment and ticker impact. Always verify material claims with the original publisher.
About AlphAI AI DeskScoring methodologyReport an issue
One HTTP Request, Every File on the Server: GitLab’s CVSS 10 Commits-API Flaw Hits Active Exploitation Within Hours — source image
Source · forkast.news
Decision brief

The 30-second read

High
01

Why it matters

The disclosed vulnerability could lead to data exfiltration, credential theft, and downstream supply‑chain attacks, prompting urgent remediation efforts.

02

Market read

First report of a critical, actively exploited GitLab vulnerability; likely to trigger short‑term price decline and heightened security spending.

03

What to watch

Potential increased demand for managed GitLab.com services as customers migrate away from self‑hosted instances.

Relevance 7/10Novelty 8/10Timing: post‑disclosure today

Background

GitLab is a leading provider of source‑code management and CI/CD tools, with a large base of self‑managed installations.

Market effects

Sector

Raises security risk concerns for CI/CD and DevOps tooling providers, potentially affecting peers like Atlassian and Azure DevOps.

Regional

Global impact on enterprises using self‑hosted GitLab instances, especially in North America and Europe.

Global

Highlights supply‑chain security vulnerabilities in software development platforms worldwide.

Counterpoint

What could challenge this read

If GitLab quickly rolls out patches and offers compensation, the stock may recover faster than typical security breach reactions.

Key entities

  • company
    GitLab

    Provider of DevOps platform; subject of the vulnerability disclosure.

  • vulnerability
    CVE-2026-85706

    Critical path‑traversal flaw in the Commits API.

  • regulator
    CISA

    Added the flaw to its Known Exploited Vulnerabilities catalog.

Read at source← All news

Also covered by

1 outlet

Related articles

SEP 28
$GTLBMedAI 8/10

Gitlab director Sytse Sijbrandij sells $101m in stock

Gitlab Inc. (GTLB) director Sytse Sijbrandij sold $101.1 million in shares from September 24-28, 2026, at prices between $44.83 and $49.12. The sales were part of a 10b5-1 plan. GitLab's stock has risen 127% in six months, with a 85.9% gross profit margin. The company recently beat Q2 earnings expectations, raising its outlook and prompting multiple analysts to increase price targets to $52-$60.

uk.investing.com2 min
SEP 23
$GTLBLow

How AI Automation Tools Will Impact GitLab (GTLB) Investors

GitLab (GTLB) released version 19.4, expanding its AI automation tools with goal-driven automation, new model options, and Slack integration. The update aims to make AI usage more controllable and budgetable. Analysts project $1.6B revenue and $185.5M earnings by 2029, assuming 15.3% yearly growth. The biggest risk is execution against competitors like GitHub. Some analysts see up to 14% upside from the current price.

simplywall.st3 min
SEP 16
$GTLBHighAI 8/10

GitLab Q2 Earnings Call Signals Broad

GitLab (GTLB) reported Q2 revenue of $286.3M, up 21% YoY, and raised full-year guidance. Key highlights include record gross bookings, 42% net ARR growth, and strong first-order activity. Profitability exceeded expectations, with non-GAAP operating income of $42.6M. The company noted AI usage growth and early adoption of its Flex model.

tipranks.com3 min
SEP 14
Med

GitLab Patches Critical Flaw Exploited in the Wild

GitLab released a critical patch for a maximum-severity flaw (CVE-2026-85706) in its repository commits API, which is being actively exploited. The vulnerability affects both Community and Enterprise Editions. U.S. authorities have set a remediation deadline for federal agencies. The patch addresses 17 other vulnerabilities, including a critical insecure deserialization flaw (CVE-2026-87719).

technobezz.com2 min
SEP 12
MedAI 8/10

GitLab CVE-2026-85706: CVSS 10.0 Flaw Under Attack

GitLab disclosed a critical flaw (CVE-2026-85706) in its repository commits API, scoring a perfect CVSS 10.0. The bug allows unauthenticated attackers to read arbitrary files. GitLab released patches, but active exploitation was observed within 24 hours. CISA added the flaw to its Known Exploited Vulnerabilities catalog, urging immediate action.

tech-insider.org3 min
SEP 11
$GTLBMedAI 8/10

Max severity GitLab path traversal flaw under active reconnaissance

GitLab patched a critical vulnerability (CVE-2026-85706) in its Community and Enterprise Editions, actively exploited in the wild. The flaw, with a CVSS score of 10.0, could allow unauthenticated file access. WatchTowr detected probes and validated exposure. Users of self-managed instances are urged to upgrade. GitLab also fixed another critical flaw (CVE-2026-87719) with a CVSS score of 9.9, enabling unauthorized access to sensitive data.

scworld.com2 min