GitLab Patches Critical File-Read Flaw After Active Probes

GitLab has released urgent patches to fix a critical security flaw that allows unauthorized users to read arbitrary files from the server. The vulnerability, rated with a perfect score of 10.0, stems from a path traversal issue in the repository commits API. This bug effectively removes the need for authentication, letting attackers access sensitive data if specific conditions are met.

The risk is immediate. According to The Hacker News, probes targeting this weakness began within hours of the public disclosure. Security firm watchTowr confirmed active scanning starting in the early hours of September 11, 2026. This rapid reaction underscores the high value attackers place on GitLab instances, which often house source code and critical infrastructure secrets.

Unauthenticated access exposes sensitive secrets

The core problem is improper path confinement combined with missing authentication enforcement. An attacker does not need a user account to exploit this. By crafting specific requests, they can navigate the server's file system to locate log files and configuration documents. These files frequently contain credentials and API keys that could be used to compromise other systems.

The barrier to exploitation is surprisingly low. Jake Knott, head of threat intelligence at watchTowr, noted that the only requirement is for at least one public project to exist on the instance. This means that even organizations with strict internal security policies are vulnerable if they have any public-facing repository, making the threat widespread for self-managed users.

Second critical bug in recent weeks

This incident follows a previous critical vulnerability in GitLab, a GraphQL code injection flaw that was also exploited quickly. The repetition of high-severity bugs in a short timeframe is concerning for defenders. It suggests that attackers are specifically targeting GitLab platforms to gain access to source code and continuous integration pipelines.

Compromising these pipelines allows attackers to inject malicious code into build processes. This can poison downstream applications and infrastructure. The strategic appeal of GitLab lies in its central role in modern software development, making it a high-value target for threat actors seeking persistent access.

Urgent patching required for self-managed users

GitLab has addressed this issue in versions 19.3.2, 19.2.6, and 19.1.8. These updates also fix a separate critical bug in the Enterprise Edition related to insecure deserialization. Organizations running self-managed instances exposed to the internet must apply these patches immediately. If patching is not possible, limiting public access to the instance is a necessary temporary measure.

Security experts warn that mass exploitation is likely imminent. Defenders have very little time to react. Organizations should review their logs for specific HTTP POST requests to the repository commits API that contain file path parameters. Identifying these attempts can help assess whether an intrusion has already occurred.