GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure. The vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under

Report facts: The article describes a CVSS 10.0 path traversal vulnerability (CVE-2026-85706) in GitLab’s repository commits API that allows unauthenticated attackers to read arbitrary files on the GitLab server, and notes that the flaw began seeing in-the-wild probing shortly after disclosure. RealGround analysis: Because many AI development and MLOps pipelines rely on GitLab for code hosting, CI/CD, and configuration storage, exploitation could expose model code, configuration, secrets, or data paths used by AI systems, creating significant downstream risk. Organizations should treat GitLab as a critical component of their AI supply chain, ensure rapid patching, and maintain SBOM-level visibility of such dependencies in AI workflows, backed by periodic security readiness assessments to verify that AI-related repositories and infrastructure are not exposed by similar platform-level flaws.