GitLab patches critical file-read flaw in self-managed servers

GitLab released versions 19.3.2, 19.2.6 and 19.1.8 on 10 September to address security issues including a critical flaw that could allow an unauthenticated user to read files from a server. Its patch notice rates CVE-2026-85706 at CVSS 10.0 and identifies weaknesses in authentication and path confinement.

Canada’s Cyber Centre said CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 11 September. That official follow-up established a reason to prioritise the fix beyond the severity score alone. It did not supply an attacker identity or a count of compromised servers. A catalogue entry signals evidence of exploitation somewhere; it does not establish that any specific customer’s server was attacked or that all exposed installations lost data.

The release required action from administrators of affected self-managed installations. GitLab said GitLab.com was already patched and GitLab Dedicated customers did not need to act. The same release addressed CVE-2026-87719, a separate critical issue involving GraphQL subscriptions and credentials in GitLab Enterprise Edition.

GitLab later backported both fixes to 19.0.9 and 18.11.12 on 23 September. These versions widened the available remediation paths for administrators on older release branches.

The distinction between hosted and self-managed deployments is practical: a vendor’s patch to its own service does not update a customer-operated server. The release notice calls for affected installations to move to a fixed version and provides detection guidance for administrators investigating possible exploitation.