Perfect-10 GitLab bug under attack days after patch lands

{
  "signal_id": "195820ec-df0c-23ee-da90-b570fdc3cb5a",
  "signal_type": "news",
  "signal_subtype": "security_incident",
  "detected_at": "2026-09-14T14:30:00+00:00",
  "company": {
    "name": "GitLab",
    "domain": "gitlab.com"
  },
  "data": {
    "url": "https://www.theregister.com/security/2026/09/14/perfect-10-gitlab-bug-under-attack-days-after-patch-lands/5296176",
    "title": "Perfect-10 GitLab bug under attack days after patch lands",
    "excerpt": "security CISA confirms active exploitation as watchTowr spots miscreants probing internet-facing servers CISA says attackers are exploiting a maximum-severity GitLab flaw that lets unauthenticated miscreants read arbitrary files from vulnerable servers after the code shack released fixes on September 10. The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog . The vulnerability is a path traversal bug in the repository commits API affecting GitLab Community Edition and Enterprise Edition. GitLab rates it a perfect 10.0, the maximum score on the CVSS v3.1 severity scale. Under certain conditions, an attacker doesn't need to log in before abusing the flaw to read arbitrary files from the GitLab server. GitLab blamed the problem on improper path confinement combined with missing authentication enforcement in the affected API. That's not an especially comforting combination on a platform that can be stuffed with source code, configuration files, and credentials. GitLab shipped fixes on September 10 in versions 19.3.2, 19.2.6 and 19.1.8, and urged operators of affected self-managed installations to upgrade immediately. The bug affects versions from 18.7 before 19.1.8, the 19.2 branch before 19.2.6, and 19.3 before 19.3.2. GitLab.com is already patched, while GitLab Dedicated customers don't need to take...",
    "summary": "GitLab is experiencing active exploitation of a maximum-severity vulnerability (CVE-2026-85706) in its Community and Enterprise Editions, allowing unauthenticated attackers to read arbitrary files from servers.",
    "planning": false,
    "image_url": "https://image.theregister.com/5279434.jpg?imageId=5279434&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683",
    "confidence": 1,
    "published_at": "2026-09-14T14:30:00Z",
    "vulnerability": "CVE-2026-85706, a path traversal bug in the repository commits API",
    "article_sentence": "CISA says attackers are exploiting a maximum-severity GitLab flaw that lets unauthenticated miscreants read arbitrary files from vulnerable servers after the code shack released fixes on September 10."
  }
}

curl https://signals.autobound.ai/v1/signals/195820ec-df0c-23ee-da90-b570fdc3cb5a \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"gitlab.com","limit":20}'