VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 08:36 UTC
← Dashboard

CVE-2026-85706

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the Git…

Read full description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
CVSS 10.0 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
7.5/10
REALITY · THREAT PRIORITY
9.0/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 10: +1.50
  • Fresh EPSS: 97.36%: +0.49

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 53 documents and public datasets.

Hype components

Headline sample (25%)
60/100
Press, 30 days (60%)
100/100
Grounded branding (15%)
0/100
HYPE TOTAL75/100

Sources and documents

Forkast News
Press · 31 Oct 2026, 13:18 · GitLab Orbit Puts a Shared Lifecycle Graph Behind Multiple Agents - Forkast News
https://tech-insider.org/
Press · 31 Oct 2026, 03:24 · GitLab CVE-2026-97229: CVSS 10.0 Joins CISA KEV [2026] - https://tech-insider.org/
Security Affairs
Press · 30 Oct 2026, 21:04 · U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog - Security Affairs
Mezha.net
Press · 30 Oct 2026, 13:27 · CISA confirms active exploitation of critical GitLab vulnerability - Mezha.net
BleepingComputer
Press · 30 Oct 2026, 13:00 · CISA says max severity GitLab flaw now exploited in the wild - BleepingComputer
See all 53 source documents
SecurityWeek
Press · 30 Oct 2026, 09:32 · Max-Severity GitLab Vulnerability Exploited Against Alpine Linux - SecurityWeek
Techzine Global
Press · 30 Oct 2026, 08:40 · GitLab tackles sky-high token usage with Orbit - Techzine Global
CyberSecurityNews
Press · 30 Oct 2026, 08:28 · CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks - CyberSecurityNews
The Hacker News
Press · 30 Oct 2026, 07:27 · CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV - The Hacker News
Trefis
Press · 29 Oct 2026, 20:10 · Can GitLab Stock Get Back To Where It Was? - Trefis
marketscreener.com
Press · 29 Oct 2026, 15:37 · GitLab Inc. Announces General Availability of GitLab Orbit - marketscreener.com
GitLab
Press · 29 Oct 2026, 13:40 · GitLab Orbit is GA: Higher agent accuracy, lower token cost - GitLab
StreetInsider
Press · 29 Oct 2026, 13:25 · GitLab launches Orbit context graph for AI agents - StreetInsider
The Hacker News
Press · 29 Oct 2026, 09:05 · Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open - The Hacker News
shattered.io
Press · 28 Oct 2026, 04:05 · GitLab RCE Hits CVSS 10.0, 7 Branches Patched [2026] - shattered.io
Yahoo Finance
Press · 27 Oct 2026, 13:55 · GitLab Inc. (GTLB) Eases AI Disruption Fears After Exceptional Q2 Results, Madison Small Cap Fund Says - Yahoo Finance
The Hacker News
Press · 23 Oct 2026, 17:54 · Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws - The Hacker News
GitLab
Press · 22 Oct 2026, 23:45 · PHP2Shell: GitLab helps find and remediate critical PHP flaws - GitLab
The Register
Press · 22 Oct 2026, 17:36 · Max-severity GitLab bug allows remote code execution over 12 years of releases - The Register
BleepingComputer
Press · 22 Oct 2026, 11:41 · GitLab warns of new max severity code execution vulnerability - BleepingComputer
The Hacker News
Press · 21 Oct 2026, 07:00 · Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases - The Hacker News
about.gitlab.com
Press · 20 Oct 2026, 07:00 · Redesign how your team ships software with AI agents - about.gitlab.com
GitLab
Press · 13 Oct 2026, 07:00 · Introducing GitLab's agent orchestration for software development - GitLab
GitLab
Press · 13 Oct 2026, 07:00 · Scaling Git for the agentic software factory - GitLab
The Hacker News
Press · 13 Oct 2026, 07:00 · GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code - The Hacker News
GitLab
Press · 06 Oct 2026, 07:00 · GitLab Announces the Foundation for the Governed Software Factory - GitLab
Security Boulevard
Press · 15 Sep 2026, 07:00 · GitLab Unauthenticated Path Traversal Exploited in the Wild (CVE-2026-85706) - Security Boulevard
Cyber Daily
Press · 14 Sep 2026, 07:00 · Act now! Hackers probing critical GitLab vulnerability just 1 day after patching - Cyber Daily
Cybersecurity Dive
Press · 14 Sep 2026, 07:00 · Malicious actors already using critical GitLab flaw, CISA and others warn - Cybersecurity Dive
SOC Prime
Press · 14 Sep 2026, 07:00 · CVE-2026-85706: Critical GitLab Path Traversal Flaw Exploited in the Wild - SOC Prime
CSO Online
Press · 14 Sep 2026, 07:00 · A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove - CSO Online
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 14 Sep 2026, 07:00 · GitLab Multiple Vulnerabilities - Hong Kong Computer Emergency Response Team Coordination Centre
SOCRadar Extended Threat Intelligence Platform
Press · 14 Sep 2026, 07:00 · GitLab CVE-2026-85706 Added to CISA KEV - SOCRadar Extended Threat Intelligence Platform
TechRadar
Press · 14 Sep 2026, 07:00 · CISA warns hackers are exploiting max severity GitLab flaw — urges all businesses to patch immediately - TechRadar
Dark Reading
Press · 14 Sep 2026, 07:00 · Maximum Severity GitLab Flaw Puts Supply Chains at Risk - Dark Reading
Rapid7
Press · 14 Sep 2026, 07:00 · CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild - Rapid7
BleepingComputer
Press · 14 Sep 2026, 07:00 · CISA: Hackers now exploit max severity GitLab flaw in attacks - BleepingComputer
The Register
Press · 14 Sep 2026, 07:00 · Perfect-10 GitLab bug under attack days after patch lands - The Register
Security Affairs
Press · 13 Sep 2026, 07:00 · GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours - Security Affairs
Hacker News
Press · 12 Sep 2026, 08:01 · Improper Limitation of a Pathname to a Restricted Directory in GitLab 10/10
CyberSecurityNews
Press · 12 Sep 2026, 07:00 · CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks - CyberSecurityNews
CyberSecurityNews
Press · 12 Sep 2026, 07:00 · CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks - CyberSecurityNews
https://tech-insider.org/
Press · 12 Sep 2026, 07:00 · GitLab CVE-2026-85706: CVSS 10.0 Flaw Under Attack - https://tech-insider.org/
LinkedIn
Press · 12 Sep 2026, 07:00 · GitLab Issues Emergency Security Update For Maximum-Severity Vulnerability - LinkedIn
SC Media
Press · 11 Sep 2026, 07:00 · Max severity GitLab path traversal flaw under active reconnaissance - SC Media
BleepingComputer
Press · 11 Sep 2026, 07:00 · GitLab urges users to patch max severity path traversal flaw - BleepingComputer
Cyber Press
Press · 11 Sep 2026, 07:00 · GitLab Patches Critical Flaws Enabling Arbitrary File Read, Credential Theft and Remote Code Execution - Cyber Press
GBHackers News
Press · 11 Sep 2026, 07:00 · Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code - GBHackers News
CyberScoop
Press · 11 Sep 2026, 07:00 · GitLab’s critical flaw is already drawing internet-wide probes - CyberScoop
Forkast News
Press · 11 Sep 2026, 07:00 · One HTTP Request, Every File on the Server: GitLab’s CVSS 10 Commits-API Flaw Hits Active Exploitation Within Hours - Forkast News
The Hacker News
Press · 11 Sep 2026, 07:00 · GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure - The Hacker News
CyberSecurityNews
Press · 11 Sep 2026, 07:00 · GitLab Patches Critical Flaws Enabling Arbitrary File Read, Credential Theft and Remote Code Execution - CyberSecurityNews
watchTowr
Press · 10 Sep 2026, 07:00 · Rapid Reaction: GitLab Path Traversal Vulnerability (CVE-2026-85706) - watchTowr

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 7.5 · reality 9.0 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

8

Public exploit entries / repo candidates

See 8 repos with metrics
RepositoryStarsForksLanguageUpdated
guneykabel/cve-2026-85706447Python11 Sep 2026, 16:38
0xlyvio/cve-2026-85706-poc-exploit-gitlab40Python12 Sep 2026, 20:42
gagaltotal/CVE-2026-85706-gitlab-poc10Go13 Sep 2026, 14:33
plur1bu5/gitread10Python13 Sep 2026, 20:10
tc4dy/CVE-2026-85706-PoC-Toolkit10Python08 Oct 2026, 20:10
unh00k3d/cve-2026-8570610Shell27 Sep 2026, 08:57
gabrielunknown/CVE-2026-8570600Perl14 Sep 2026, 17:28
solivaquaant/CVE-2026-8570600Python11 Sep 2026, 19:47
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 10; EPSS 97.4%
Attention, last 30 days
25 distinct story titles; 25 press documents; 1 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-06 00:12:49.640935+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
10 Sep 2026, 07:00
Added to the CISA KEV catalog
11 Sep 2026, 00:00
Published
12 Sep 2026, 02:46
Latest press mention
31 Oct 2026, 13:18
Score calculated
06 Nov 2026, 00:12
PoCs on GitHub
8 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar