CVE-2026-92470 – GitLab

GitLab has released fixes for eight vulnerabilities in GitLab CE/EE that expose servers to file theft, code execution and leaks of CI/CD secrets. The most serious is CVE-2026-85706, which has a CVSS score of 10.0, Critical severity. A missing authentication check and improper path handling in the repository commits API let an unauthenticated attacker read arbitrary files from the GitLab server. Attackers are actively exploiting CVE-2026-85706. Three more Critical flaws enable server compromise: CVE-2026-87719 has a CVSS score of 9.9, Critical severity, and lets Duo Chat users pull Advanced Search configurations and credentials through a crafted GraphQL subscription. CVE-2026-89078 has a CVSS score of 9.9, Critical severity, and CVE-2026-93577 has a CVSS score of 9.9, Critical severity. Both let authenticated users run arbitrary code on the server through crafted regular expressions in a CI/CD configuration.

The update also closes four High severity flaws. CVE-2026-88765 has a CVSS score of 8.5, High severity, and allows remote code execution through a crafted Git project import. CVE-2026-79708 has a CVSS score of 8.5, High severity, and lets developers run policy test pipelines that expose protected CI/CD variables. CVE-2026-13210 has a CVSS score of 7.7, High severity, and CVE-2026-92470 has a CVSS score of 7.7, High severity. Both expose CI/CD variables outside their intended scope, one through the environment scope matcher and one through Duo AI troubleshooting of debug job traces. Upgrade to GitLab 18.11.12, 19.0.9, 19.1.8, 19.2.7, 19.3.3 or 19.4.1, depending on your release line.