AI News Feed
Market watch
Wired vs. Wireless Gaming Mice: Performance Gap Narrows, Pros Choose WirelessTrump Warns 'Traitors and Leakers' to 'Beware' Over AI Conspiracy, TechRadar ReportsRoborock's Saros 20 Flow goes on sale in the US with self-cleaning roller mopResearchers Say Twitch Extension JeeBot Sent 31,000 Users' OAuth Tokens to Russian ProxiesNintendo's 'Customer Appreciation' Sale Discounts Switch Games and Accessories Through Sept. 269to5Mac Picks iPhone 18 Pro Accessories Ahead of Delivery Day
Wired vs. Wireless Gaming Mice: Performance Gap Narrows, Pros Choose WirelessTrump Warns 'Traitors and Leakers' to 'Beware' Over AI Conspiracy, TechRadar ReportsRoborock's Saros 20 Flow goes on sale in the US with self-cleaning roller mopResearchers Say Twitch Extension JeeBot Sent 31,000 Users' OAuth Tokens to Russian ProxiesNintendo's 'Customer Appreciation' Sale Discounts Switch Games and Accessories Through Sept. 269to5Mac Picks iPhone 18 Pro Accessories Ahead of Delivery Day
Cybersecurity

CISA Warns Hackers Exploiting Maximum-Severity GitLab Flaw, Orders Federal Agencies to Patch in Three Days

CISA has added a maximum-severity GitLab path traversal flaw to its exploited-vulnerabilities catalog and told federal agencies to patch within three days.

AI News Feed · 2026-09-15 05:54

TechRadar reported that GitLab has updated Community Edition and Enterprise Edition to versions 19.3.2, 19.2.6, and 19.1, fixing a range of security issues. Two are rated critical: a path traversal flaw in the repository commits API and an insecure deserialization issue in the GraphQL subscription serializer. The path traversal bug is tracked as CVE-2026-85706 and has a severity score of 10 out of 10. According to the report, it stems from missing authentication enforcement and improper path confinement in the repository commits API, allowing unauthenticated attackers to read sensitive information such as login credentials or secrets.

GitLab’s advisory did not say the flaws were being abused in the wild. A separate report from cybersecurity firm watchTowr, released a day later, said it was already observing in-the-wild probes for CVE-2026-85706. “watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab Path Traversal vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request,” the researchers said. They added that based on recent GitLab vulnerabilities, the time until indiscriminate exploitation was likely not far away, and advised defenders to search logs for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters.

At the same time, CISA added the bug to its KEV catalog, confirming the claims and giving government users a three-day window to apply the patch. The KEV listing means federal agencies must remediate the vulnerability within the deadline set by CISA, a compressed timeline that reflects active exploitation.

GitLab is an intelligent orchestration platform for DevSecOps professionals, helping organizations automate and streamline the software development cycle. The company has more than 50 million registered users, and roughly 50 percent of Fortune 100 companies use it, according to an SEC filing cited in the report.

Editor's Summary

The U.S. cybersecurity agency has added CVE-2026-85706, a 10/10 GitLab repository commits API path traversal flaw, to its Known Exploited Vulnerabilities catalog. GitLab has released fixed versions 19.3.2, 19.2.6, and 19.1, while watchTowr says it has observed exploitation probes. Federal agencies have three days to update, and CISA is urging other businesses to patch immediately.