Critical GitLab flaw lets outsiders read secrets from servers with public projects
A newly disclosed GitLab vulnerability with the maximum CVSS 10 severity score allows unauthenticated attackers to read log and configuration files on any instance that hosts at least one public project, and probes began within hours of the bug becoming public.
One of the core tools behind modern software development has a hole big enough for attackers to crawl through without even logging in.
GitLab has disclosed a file‑read vulnerability, tracked as CVE‑2026‑85706, and it’s severe enough to earn a 10 out of 10 rating on the Common Vulnerability Scoring System. The flaw affects GitLab instances that have at least one public project, a category that includes many open‑source and corporate deployments.
Exploiting the bug doesn’t require a password or special access. An unauthenticated attacker can use it to read log files and configuration files stored on the server. In many real‑world setups, those files hold more than harmless settings: they often contain database credentials, tokens, cloud keys, and internal service passwords.
That turns a simple file‑read bug into a potential pivot point. Once an attacker can see those secrets, they may be able to move on to private repositories, development pipelines, or infrastructure connected through GitLab integrations.
Security observers say that probes for the vulnerability began within hours of disclosure. Scanning traffic aimed at the newly described bug showed up quickly, suggesting that opportunistic attackers were racing to find exposed servers before administrators could patch or lock them down.
The risk runs through the software supply chain. Organizations rely on GitLab to store code, automate testing, and push updates into production systems across sectors from finance to healthcare. If an attacker uses CVE‑2026‑85706 to steal credentials or tamper with development pipelines, they can potentially insert malicious changes into software that millions of end users trust.
The incident also highlights how operational leftovers like logs and configuration files can become high‑value targets. They are often treated as low‑sensitivity, but when they contain credentials and can be read from outside, they become a direct path into the heart of an organization’s systems.
What matters now is how fast GitLab operators update or mitigate vulnerable instances, whether cloud providers report real‑world breaches tied to this flaw, and whether any organizations come forward to say CVE‑2026‑85706 was the starting point for a wider compromise.
Sources
- OSINT