GitLab's Maximum-Severity Vulnerability: A Supply Chain Security Wake-Up Call
CVE-2026-85706, a maximum-severity path traversal vulnerability in GitLab Community and Enterprise Editions, is being actively exploited by threat actors to compromise software supply chains. The flaw, which received a CVSS score of 10.0, allows unauthenticated attackers to read arbitrary files from GitLab servers, including sensitive credentials and CI/CD secrets. GitLab disclosed and patched the vulnerability on September 10, 2026, but CISA added it to their Known Exploited Vulnerabilities catalog within days due to observed exploitation in the wild. Researchers detected rapid escalation from initial probes to full exploitation, with attackers extracting configuration files and SSH credentials that could enable complete system compromise and lateral movement into development environments. This incident highlights the growing threat to software supply chains as adversaries increasingly target development platforms to gain privileged access to source code, build processes, and deployment pipelines across multiple organizations.
Kill Chain
