Affected Systems
GitLab Community Edition (CE) and Enterprise Edition (EE): all versions 18.7 to 19.1.7, 19.2.0 to 19.2.5, and 19.3.0 to 19.3.1. Requires at least one public project to exist on the instance.
Exploitation Status
Active in-the-wild probing observed since 06:00 UTC September 11, 2026, within hours of public disclosure. Mass exploitation expected imminently based on historical patterns.
Business Impact
Unauthenticated attackers can read arbitrary files from internet-exposed GitLab servers, including log files and configuration files containing credentials, secrets, CI/CD tokens, and source code. This enables lateral movement, supply chain attacks via build pipeline poisoning, and credential theft. Self-managed GitLab instances with public projects are at immediate risk.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade self-managed GitLab instances to version 19.3.2, 19.2.6, or 19.1.8 depending on your release track
- If immediate patching is not possible, restrict public access to GitLab instances or disable public projects until patching is complete
- Review web server and GitLab logs for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.Path' parameters to identify exploitation attempts
- Rotate all credentials, secrets, and API tokens stored in GitLab configuration files and accessible via logs as a precautionary measure
- Verify integrity of CI/CD pipelines and review recent commits for unauthorized code injection or modifications