GitLab CVE-2026-85706: Unauthenticated Path Traversal Exposes SSH Keys and CI/CD Secrets

The GitLab repository commits API at /api/v4/projects/{id}/repository/commits/ accepts batch file operation requests in POST body JSON. The standard use case lets authorized users create a commit that adds or modifies files by specifying the file path and content in the request body.

CVE-2026-85706 exploits two simultaneous failures in this endpoint. First, the endpoint fails to enforce authentication for the API call. A request without an Authorization header or PRIVATE-TOKEN header proceeds past the authentication check rather than returning a 401 Unauthorized response. Second, the file.path parameter value is not normalized before the server uses it to locate the file. When an attacker supplies a value like ../../../../etc/passwd or ../../../../home/git/.gitlab_shell_secret, the server traverses outside the repository working directory and reads the file at the resolved absolute path.

The server then includes the retrieved file content in the API response body, returning it to the attacker over a normal HTTP 200 response. No error is thrown. The response looks structurally similar to a successful commit creation, with the file content embedded in the diff output fields.

The attack requires three things: a reachable GitLab API endpoint over TCP/443 or TCP/80, a valid project ID (which can be any numeric ID, including ID 1 for the first project -- publicly visible on any self-managed instance with public visibility enabled), and knowledge of the target file path relative to the traversal depth.

watchTowr's analysis confirmed the technique works against all affected versions and documented the first in-the-wild probing at 06:00 UTC on September 11, 2026, less than 24 hours after patches shipped. Attacks were observed against internet-exposed GitLab instances with both the commits API accessible from public addresses.

GitLab stores multiple high-value secrets on disk in predictable locations. CVE-2026-85706 gives unauthenticated attackers access to all of them.

.gitlab_shell_secret is the shared secret that GitLab uses to authenticate its own shell component for SSH-based git operations. An attacker who retrieves this value can forge SSH-authenticated requests to GitLab's internal APIs, effectively impersonating the GitLab server itself. This breaks the trust relationship that protects every repository hosted on the instance.

SSH host private keys at /etc/ssh/ssh_host_rsa_key, ssh_host_ecdsa_key, and ssh_host_ed25519_key are typically readable by the gitlab user depending on system configuration. An attacker who retrieves the SSH host private key can impersonate the GitLab server during SSH connections, enabling man-in-the-middle attacks against developers cloning repositories over SSH.

gitlab.rb and secrets.yml contain the database connection string including password, SMTP server credentials, S3 bucket credentials for artifact storage, Kubernetes integration tokens, and the db_key_base value used to encrypt stored secrets. Decrypting stored secrets with db_key_base gives attackers access to every personal access token, deploy token, and integration credential stored in the database.

CI/CD pipeline variables stored in configuration files or referenced in the GitLab runner configuration are accessible if file paths are known. Exposed CI/CD credentials can trigger supply chain insertions into any pipeline that trusts the compromised GitLab instance -- the same attack vector that produced the LiteLLM supply chain breach and 434,000 CI/CD credential exposures.

Organizations that stored AWS IAM keys, Vault tokens, Kubernetes service account credentials, or container registry tokens in GitLab CI/CD variables should treat those credentials as compromised and rotate them immediately.

Security researchers at watchTowr and Horizon3.ai began tracking active exploitation probes against internet-exposed GitLab instances at 06:00 UTC on September 11, 2026 -- within 24 hours of the patch release. CISA formally added CVE-2026-85706 to the Known Exploited Vulnerabilities catalog the same day, citing evidence of active exploitation in the wild.

The exploitation pattern follows a reconnaissance-first methodology consistent with organized initial access broker activity. Attackers probe for .gitlab_shell_secret and SSH host keys in a first wave, then return to instances that responded with expected file sizes for deeper credential extraction targeting gitlab.rb and secrets.yml. This staged approach suggests attackers are automating the initial probe against wide target lists and manually prioritizing the most valuable instances for follow-up.

GitLab servers in defense-industrial-base, financial services, and technology sector organizations represent the highest-value targets given that these instances are most likely to host CI/CD pipelines with production cloud credentials attached. GitLab instances used for internal tool development at enterprises often have direct connections to production Kubernetes clusters, AWS accounts, and artifact repositories -- making the CI/CD credential exposure vector more damaging than the SSH key theft in many environments.

The 24-hour exploitation window from patch release to active attacks mirrors the pattern observed when GitLab released patches for prior critical vulnerabilities. Attackers routinely analyze patch diffs to reverse-engineer the underlying flaw and build exploit code faster than most organizations cycle through patch approval and deployment. Organizations with self-managed GitLab instances that do not patch within 24 to 48 hours of a critical security release consistently enter the active exploitation window.

The following Sigma rules detect exploitation attempts against CVE-2026-85706 using web server access logs. Rule 1 catches the initial path traversal probe in real time; Rule 2 identifies successful file reads by correlating response status and body characteristics with the vulnerable endpoint.

Deploy via your SIEM's log ingestion for nginx, Apache, or GitLab's own Unicorn/Puma logs. Both rules target access logs with the cs-method, cs-uri-stem, and sc-status fields standard in W3C Extended Log Format. If your log format differs, adapt the field names to match your log schema before deploying.

Rule 1: GitLab Commits API Path Traversal Probe -- Targets the initial exploitation attempt at the network level, requiring only access logs with HTTP method and URI fields. Rule 2: GitLab Sensitive File Read via Commits API -- Targets successful exploitation by correlating a POST to the commits API with an HTTP 200 response, indicating the server returned file content instead of rejecting the request.

No specific threat actor infrastructure (C2 domains, attacker IPs) has been publicly attributed to the CVE-2026-85706 exploitation campaign as of September 14, 2026. Exploitation is currently opportunistic, with automated scanners probing internet-exposed GitLab instances. The following behavioral and structural indicators are derived from confirmed exploitation technique and watchTowr's log analysis guidance.

The primary detection artifact is the POST request to the commits API endpoint with file.path values outside the repository root. Successful exploitation is distinguished from failed attempts by the HTTP 200 response code combined with a response body size larger than expected for a commit rejection error (which returns a compact JSON error object typically under 200 bytes).

GitLab application logs (at /var/log/gitlab/gitlab-rails/production.log) record API requests with fuller body details than nginx access logs and are a higher-fidelity source for detecting this exploit. Review both log sources.

For organizations that have already patched: search logs from September 10 through today for the URI pattern and response characteristics described below. Any successful 200-response POST to the commits API that was made without a valid Authorization header warrants credential rotation for all secrets stored on that server.

Remediation requires upgrading your self-managed GitLab instance and rotating all credentials accessible from the server filesystem. Address the patch first, then credential rotation even if you have no evidence of exploitation -- attackers may have read credentials without triggering obvious log entries if your logging verbosity was set below the default.

GitLab is not just a code repository -- it is the trust anchor for your entire software supply chain. Every CI/CD pipeline that builds, tests, and deploys your software runs under credentials stored in or managed through GitLab. When those credentials are exposed, attackers gain the ability to insert malicious code into your build pipeline, push to protected branches with stolen deploy tokens, access production cloud environments with CI/CD-attached IAM roles, and pivot into every external system that your automation accounts can reach.

The path traversal vulnerability in CVE-2026-85706 is particularly dangerous because it does not require the attacker to have any prior access to the GitLab environment. Unlike post-authentication vulnerabilities that require a compromised account as a starting point, this flaw gives any internet-visible self-managed GitLab instance zero protection against an attacker who sends a single HTTP POST request.

Organizations running self-managed GitLab in on-premises data centers, private cloud VPCs, or containerized environments face the highest risk. Public-facing GitLab instances that do not require VPN access are directly exploitable from any IP address. But even internal GitLab instances accessible only from within the corporate network represent a risk if the network contains any compromised endpoint with API access -- which is a realistic assumption after any phishing or initial access event.

See also the MLflow SSRF credential theft pattern for a parallel developer-infrastructure vulnerability that similarly exposed cloud credentials through a single unauthenticated request.

The CISA federal remediation deadline of September 14 reflects the agency's assessment that active exploitation is ongoing and escalating. Organizations that treat this as a routine patch cycle rather than an emergency response are accepting material risk of a supply chain compromise that may take weeks to detect.