GitLab CVE-2026-85706: Six Lines Without a Fix, 19.1 Ends September 17
GitLab has a CVSS 10.0 flaw that lets an unauthenticated stranger read files off a self-managed server, CISA put it on the Known Exploited Vulnerabilities catalog on September 11, 2026 with a three-day deadline, and the fix exists for exactly three release lines. GitLab's critical patch release of September 10, 2026 ships 19.3.2, 19.2.6 and 19.1.8 and states the impacted versions as “all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.” Read the two halves of that sentence together. Every line from 18.7 up is affected; only 19.1, 19.2 and 19.3 get a build.
That is not an oversight. GitLab's maintenance policy, read live today, backports security fixes to “the previous two monthly releases in addition to the current stable release” and lists the maintained versions as 19.3, 19.2 and 19.1. We wrote in August that this 91-day window would leave 19.0 exposed the first time a serious flaw landed. It landed.
What the flaw is
CVE-2026-85706 is a path traversal in the repository commits API. In GitLab's words, “under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement.” GitLab scores it CVSS 10.0 (network, low complexity, no privileges, no user interaction, changed scope, high confidentiality and integrity impact) and credits s3ntago through its HackerOne programme. GitLab.com was patched before the post went out; GitLab Dedicated customers need no action. The exposure is self-managed instances, which is to say the servers holding an organisation's source, CI/CD variables and deployment credentials.
CISA added it on September 11, 2026, the day after the patch, with a due date of September 14, 2026 for federal civilian agencies. watchTowr, Horizon3 and the trade press reported exploitation attempts within a day of disclosure.
Every affected line against the fix list
Dates below are our tracked GitLab data, read from GitLab's own release feed every night. “Security support ends” is the day the line drops out of GitLab's three-version maintained set.
| Line | First release | Security support ends | Fixed build | Position tonight |
|---|---|---|---|---|
| 19.3 | August 20, 2026 | November 19, 2026 | 19.3.2 | Current stable |
| 19.2 | July 16, 2026 | October 15, 2026 | 19.2.6 | Maintained |
| 19.1 | June 18, 2026 | September 17, 2026 | 19.1.8 | Maintained until 19.4 ships |
| 19.0 | May 21, 2026 | August 20, 2026 | None | Affected, unsupported |
| 18.11 | April 16, 2026 | July 16, 2026 | None | Affected, unsupported |
| 18.10 | March 19, 2026 | June 18, 2026 | None | Affected, unsupported |
| 18.9 | February 19, 2026 | May 21, 2026 | None | Affected, unsupported |
| 18.8 | January 15, 2026 | April 16, 2026 | None | Affected, unsupported |
| 18.7 | December 18, 2025 | March 19, 2026 | None | Affected, unsupported |
GitLab's range starts at 18.7 and says nothing about 18.6 and earlier, so neither do we. An instance on 18.6 or older is out of GitLab's impacted statement and out of support by a wider margin still; it needs the same upgrade for a longer list of reasons.
The 19.1 trap
The shortest path to CISA's Monday deadline for anyone on 19.1 is 19.1.8, one patch step on the same line. It is also the shortest path to being unsupported again. GitLab ships its monthly release on the third Thursday, and our data puts 19.1's end of security support on September 17, 2026: the day 19.4 ships and the maintained set becomes 19.4, 19.3 and 19.2. The next critical patch after that will be built for 19.2, 19.3 and 19.4, and a 19.1.8 instance will be back on this page's second table. 19.2.6 buys until October 15, 2026; 19.3.2 until November 19, 2026. If the upgrade has to happen this weekend anyway, make it one that lasts past Thursday.
What to do, by line
19.3 or 19.2: install 19.3.2 or 19.2.6 now. GitLab publishes upgrade paths for each; a same-line patch is a short one.
19.1: 19.1.8 meets the deadline; 19.2.6 or 19.3.2 meets the deadline and survives September 17. Prefer the second.
19.0, 18.11, 18.10, 18.9, 18.8, 18.7: there is nothing to install on your line. Take the instance off the public internet today if it is on it, then follow GitLab's upgrade path to 19.2.6 or 19.3.2. GitLab's own advice for public-facing self-managed instances is to patch immediately or remove public access, and for these lines only the second half is available until the upgrade lands.
Everyone self-managed: the flaw is an unauthenticated file read on the server. After patching, treat anything readable from the GitLab host as potentially read: rotate CI/CD variables and runner registration tokens, and review access logs on the commits API for the period since the patch release.
Federal agencies: CISA's due date is September 14, 2026, under BOD 26-04.
Frequently Asked Questions
Which GitLab versions fix CVE-2026-85706?
GitLab's critical patch release of September 10, 2026 ships the fix in 19.3.2, 19.2.6 and 19.1.8 for Community Edition and Enterprise Edition. GitLab.com is already patched and GitLab Dedicated customers need no action. GitLab states the impacted versions as all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.
Is there a fix for GitLab 19.0 or 18.x?
No. GitLab's maintenance policy backports security fixes to the current stable release and the two monthly releases before it, and names the maintained versions as 19.3, 19.2 and 19.1. GitLab 19.0 left security support on August 20, 2026; 18.11, 18.10, 18.9, 18.8 and 18.7 left it earlier. All six are inside GitLab's stated impacted range and have no fixed build. The only route is an upgrade to 19.1.8, 19.2.6 or 19.3.2.
Is GitLab 19.1.8 a safe place to land?
Only briefly. GitLab 19.1 leaves security support on September 17, 2026, when 19.4 ships and the maintained set moves to 19.4, 19.3 and 19.2. An instance patched to 19.1.8 for CISA's September 14 deadline is unsupported three days later. 19.2.6 or 19.3.2 is the upgrade that lasts.
What is the CISA deadline?
CISA added CVE-2026-85706 to the Known Exploited Vulnerabilities catalog on September 11, 2026 with a due date of September 14, 2026 for federal civilian agencies, the three-day window CISA reserves for its most urgent entries.
Related
- GitLab — every monthly line with its release day, end of bug fixes and end of security fixes, from GitLab's release feed
- GitLab 19.0 stopped receiving security patches on August 20 — the 91-day window, written before this flaw landed
- GitLab Runner — rides the same clock
- Exploited & Unpatchable — the feed of KEV entries on products past their fix window
- How we verify our dates — the rules every number on this site is held to