CVE-2026-85706: GitLab CVSS 10.0 Path Traversal Under Active Probing — Detection, Hunting, and Remediation Guide

---
title: GitLab CVE-2026-85706 Path Traversal Probe Against Repository Commits API
id: 4f8c2e91-7b3a-4d5e-9a21-6c0d8e5f2b47
status: experimental
description: Detects path traversal sequences (raw or URL-encoded) in requests to the GitLab repository commits API, consistent with CVE-2026-85706 arbitrary file read exploitation attempts.
references:
  - https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  service: nginx
detection:
  selection_api:
    cs-uri|contains: '/repository/commits'
  selection_traversal:
    cs-uri|contains:
      - '../'
      - '..\\'
      - '%2e%2e'
      - '%252e%252e'
      - '..%2f'
      - '%2e%2e/'
      - '..%5c'
  condition: selection_api and selection_traversal
falsepositives:
  - Extremely rare; legitimate commits API calls do not contain traversal sequences
level: critical
---
title: GitLab Unauthenticated API Reconnaissance and Traversal Scanning
id: 8d1e6a34-2c9f-4b7d-a3e5-9f0c1b2d4e68
status: experimental
description: Detects HTTP 4xx/2xx request bursts containing encoded dot sequences against GitLab API v4 endpoints from a single source, indicative of automated exploitation scanning following CVE-2026-85706 disclosure.
references:
  - https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.initial_access
logsource:
  category: webserver
  service: nginx
detection:
  selection_api:
    cs-uri|startswith: '/api/v4/'
  selection_encoded:
    cs-uri|contains:
      - '%2e%2e'
      - '%252e'
      - '%2f..'
      - 'etc/gitlab'
      - 'gitlab-secrets'
      - 'etc/passwd'
  condition: selection_api and selection_encoded
falsepositives:
  - Misconfigured developer tooling; validate source IP against known scanner ranges
level: high

// Hunt for CVE-2026-85706 exploitation attempts against GitLab instances
// Assumes GitLab nginx access logs forwarded via CEF/Syslog to Sentinel
let traversal = dynamic(["../", "%2e%2e", "%252e%252e", "..%2f", "%2e%2e/", "..%5c", "gitlab-secrets", "etc/passwd", "etc/gitlab"]);
let suspiciousRequests =
    CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where RequestURL has "/repository/commits" or RequestURL has "/api/v4/"
    | extend RequestURL_decoded = url_decode(RequestURL)
    | where RequestURL has_any (traversal) or RequestURL_decoded has_any (traversal)
    | project TimeGenerated, SourceIP, RequestURL, RequestURL_decoded, RequestMethod, ApplicationProtocol, DeviceProduct, Computer;
let syslogRequests =
    Syslog
    | where TimeGenerated > ago(7d)
    | where SyslogMessage has "repository/commits"
    | extend msg_decoded = url_decode(SyslogMessage)
    | where SyslogMessage has_any (traversal) or msg_decoded has_any (traversal)
    | project TimeGenerated, HostIP, Computer, SyslogMessage;
union suspiciousRequests, syslogRequests
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Attempts=count(), DistinctURIs=dcount(RequestURL)
  by SourceIP, Computer
| order by Attempts desc;
// Follow-up: identify sources that also requested /users/sign_in or version banners (fingerprinting behavior)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/api/v4/version", "/users/sign_in", "/explore")
| summarize FingerprintEvents=count() by SourceIP
| join kind=inner (
    suspiciousRequests | summarize ExploitAttempts=count() by SourceIP
) on SourceIP
| project SourceIP, FingerprintEvents, ExploitAttempts
| order by ExploitAttempts desc;

-- Artifact: Linux.Forensics.GitLabTraversalHunt
-- Hunts GitLab nginx access and Rails API logs for CVE-2026-85706 traversal attempts
-- and checks whether high-value secret files may have been exposed.

-- 1. Parse nginx access logs for traversal sequences in commits API requests
LET access_log_hits = SELECT
    parse_string_with_regex(string=Line,
        regex='^(?P<SrcIP>[0-9\.]+).*?"(?P<Method>[A-Z]+) (?P<URI>[^ ]+).*?" (?P<Status>[0-9]{3})') AS Parsed,
    Line
FROM parse_lines(filename='/var/log/gitlab/nginx/gitlab_access.log')
WHERE Line =~ 'repository/commits'
  AND (Line =~ '\.\./' OR Line =~ '(?i)%2e%2e' OR Line =~ '(?i)%252e'
       OR Line =~ '(?i)gitlab-secrets' OR Line =~ '(?i)etc/passwd')

SELECT Parsed.SrcIP AS SourceIP, Parsed.Method AS Method,
       Parsed.URI AS RequestURI, Parsed.Status AS HTTPStatus
FROM access_log_hits

-- 2. Check gitlab-rails API log for matching unauthenticated requests
SELECT Line AS ApiLogEntry
FROM parse_lines(filename='/var/log/gitlab/gitlab-rails/api_json.log')
WHERE Line =~ 'repository/commits'
  AND (Line =~ '\.\.' OR Line =~ '(?i)%2e')

-- 3. Confirm secrets file presence and last access metadata for scoping
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  '/etc/gitlab/gitlab-secrets.json',
  '/etc/gitlab/gitlab.rb',
  '/var/opt/gitlab/gitlab-rails/etc/database.yml'
])

#!/bin/bash
# CVE-2026-85706 GitLab Emergency Triage & Remediation Script
# Run as root on the GitLab server. Test in staging before production use.
set -euo pipefail

echo "=== [1/5] Current GitLab version ==="
gitlab-rake gitlab:env:info 2>/dev/null | head -20 || cat /opt/gitlab/version-manifest.txt | head -5

echo "=== [2/5] Checking installed package version ==="
if command -v dpkg &>/dev/null; then
  dpkg -l | grep -E 'gitlab-(ce|ee)'
elif command -v rpm &>/dev/null; then
  rpm -qa | grep -E 'gitlab-(ce|ee)'
fi

echo "=== [3/5] Hunting logs for traversal exploitation attempts (CVE-2026-85706) ==="
for log in /var/log/gitlab/nginx/gitlab_access.log /var/log/gitlab/nginx/gitlab_access.log.1; do
  [ -f "$log" ] || continue
  echo "--- $log ---"
  grep -iE 'repository/commits' "$log" \
    | grep -iE '(\.\./|%2e%2e|%252e|gitlab-secrets|etc/passwd|etc/gitlab)' \
    | awk '{print $1, $7, $9}' | sort | uniq -c | sort -rn | head -25 || echo "No hits in $log"
done

echo "=== [3b] Scanning archived/rotated logs ==="
zgrep -hiE 'repository/commits' /var/log/gitlab/nginx/gitlab_access.log*.gz 2>/dev/null \
  | grep -iE '(\.\./|%2e%2e|%252e)' | head -25 || echo "No hits in rotated logs"

echo "=== [4/5] Applying the GitLab security patch ==="
echo "Backing up configuration first..."
gitlab-ctl backup-etc 2>/dev/null || cp -a /etc/gitlab /root/gitlab-etc-backup-$(date +%Y%m%d)
if command -v apt-get &>/dev/null; then
  apt-get update
  apt-get install -y gitlab-ee  # use gitlab-ce if running Community Edition
elif command -v yum &>/dev/null; then
  yum makecache
  yum install -y gitlab-ee      # use gitlab-ce if running Community Edition
fi

echo "=== [5/5] Post-patch verification ==="
gitlab-rake gitlab:check SANITIZE=true 2>/dev/null | tail -20
curl -sk "https://127.0.0.1/api/v4/version" | head -c 200; echo

echo ""
echo "ACTION REQUIRED: If step 3 returned hits, treat as a confirmed incident:"
echo "  - Rotate ALL secrets in /etc/gitlab/gitlab-secrets.json (gitlab-ctl reconfigure)"
echo "  - Reset database credentials, tokens, deploy keys, and CI/CD variables"
echo "  - Review /var/log/gitlab/gitlab-rails/audit_json.log for unauthorized access"