Grade One Press

Technology reporting you can check

News · Security & privacy

Attackers are exploiting flaws in GitLab and JFrog Artifactory, where companies keep their code and builds

The GitLab flaw, scored 10 out of 10, let an unauthenticated user read any file on a self-managed server. US agencies were given three days to patch it.

Catching up: the original came out on . This story was published later, when the site opened.

Grade One Newsroom · 1 min read

Sources: 4 · top grade 1How evidence is graded

A top-severity GitLab flaw and two JFrog Artifactory flaws are being exploited

Grade 1 · Primary

Source: US Cybersecurity and Infrastructure Security Agency (CISA)

What changed
CISA listed a GitLab flaw letting unauthenticated users read server files, and two JFrog Artifactory token flaws, as exploited on 11 September.
Who it affects
Organisations running their own GitLab (versions 18.7 to 19.3.1, before the fixes) or self-hosted JFrog Artifactory older than 7.133.11.
What it does not tell you
How many servers were attacked, or whether code or secrets were taken. Neither CISA nor the vulnerability records say.

The full story Check the source

The US Cybersecurity and Infrastructure Security Agency listed a flaw in GitLab and two in JFrog Artifactory as exploited on 11 September [1].

The GitLab flaw, CVE-2026-85706, let an unauthenticated user read arbitrary files from a GitLab server through the repository commits API. GitLab scored it 10 out of 10 [2].

Federal agencies were given until 14 September to patch GitLab, and until 25 September for Artifactory [1].

What it covers

Self-managed GitLab Community and Enterprise editions from 18.7, before the fixed releases 18.11.12, 19.0.9, 19.1.8, 19.2.6 and 19.3.2 [2].

Self-hosted JFrog Artifactory before 7.133.11, whose token checks looked at the signature and issuer but not the token's scope, allowing privilege escalation [3].

The second Artifactory flaw could hand an internal anonymous-user token to an unauthenticated caller even when anonymous access was switched off [4].

What it does not tell you

How many servers were attacked, or whether code, keys or passwords were taken. None of the sources say [1][2][3][4].

Sources and their grades

  1. US Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, entries CVE-2026-85706, CVE-2026-42016 and CVE-2026-42018. Read 29 September 2026. Grade 1 · Primary Added 11 September 2026. The GitLab flaw was due 14 September for US federal agencies, the JFrog flaws 25 September.
  2. US National Vulnerability Database (NIST), CVE-2026-85706. Read 29 September 2026. Grade 1 · Primary The affected versions and the 10.0 score are GitLab's, as the reporting organisation.
  3. US National Vulnerability Database (NIST), CVE-2026-42016. Read 29 September 2026. Grade 1 · Primary Published 27 July 2026.
  4. US National Vulnerability Database (NIST), CVE-2026-42018. Read 29 September 2026. Grade 1 · Primary Published 12 August 2026.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Software development Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all