A Vulnerability in GitLab Could Allow for Disclosure of Sensitive Data

A GitLab repository commits API vulnerability (CVE-2026-85706) can be exploited via a single crafted HTTP request to disclose arbitrary files and sensitive configuration data—such as SSH keys, database credentials, deploy tokens, and CI/CD variables—potentially enabling further access; the report maps this to Initial Access (TA0001) and Exploit Public-Facing Application (T1190).