[{"data":1,"prerenderedAt":245},["ShallowReactive",2],{"seo-verification":3,"blog-cve-2026-85706-gitlab-emergency-patch-or-gitea-migration-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-cve-2026-85706-gitlab-emergency-patch-or-gitea-migration-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":33,"intro":36,"sections":37,"ctaTitle":146,"ctaBody":147,"ctaButton":148,"ctaUrl":149,"relatedPosts":150},365,"cve-2026-85706-gitlab-emergency-patch-or-gitea-migration",{"fr":12,"en":10,"ar":13,"es":14},"gitlab-cve-2026-85706-migration-gitea-vps","cve-2026-85706-gitlab-تصحيح-عاجل-أو-هجرة-إلى-gitea","cve-2026-85706-gitlab-parche-urgente-o-migracion-gitea","CVE-2026-85706 GitLab: emergency patch or Gitea migration","CVE-2026-85706 (CVSS 10.0) exposes secrets.yml and SSH keys on GitLab 18.7–19.3.1. Patch to 19.3.2 immediately or migrate to Gitea on a VPS.",9,0,false,"2026-09-19T00:00:00+00:00","2026-09-19T17:11:16+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fgitlab-cve-2026-85706-migration-gitea-vps-poster.svg",{"categorySlug":34,"appSlug":35},"development","gitea","CVE-2026-85706 is an unauthenticated path traversal vulnerability rated CVSS 10.0 affecting all self-hosted GitLab CE\u002FEE instances between versions 18.7 and 19.3.1. An attacker with basic HTTP access can read secrets.yml, runner SSH keys, and CI\u002FCD tokens without any authentication. CISA added this vulnerability to its KEV catalog on September 10, 2026, confirming active exploitation in the wild. Patch to 19.3.2 immediately or migrate to Gitea to permanently reduce your attack surface.",[38,42,52,55,71,74,84,87,102,105,143],{"type":39,"title":40,"body":41},"h2","CVE-2026-85706 — CVSS 10.0, unauthenticated path traversal","CVE-2026-85706 is a path traversal vulnerability in the repository management component of GitLab CE and EE. The CVSS vector is AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:H — no authentication required, no user interaction, full impact on confidentiality, integrity, and availability. In practice, a malformed HTTP request against the repository archives API endpoint allows an attacker to traverse the GitLab instance filesystem and reach sensitive configuration files outside the repository root. The watchTowr researcher published a working proof-of-concept shortly after disclosure, and Rapid7 teams confirmed active exploitation attempts in their ETR telemetry. CISA listed CVE-2026-85706 in its Known Exploited Vulnerabilities catalog on September 10, 2026, imposing a 72-hour remediation deadline on US federal agencies — a strong signal of the real severity of the threat.",{"type":43,"title":44,"items":45},"ul","What an attacker can read via path traversal",[46,47,48,49,50,51],"secrets.yml — contains the active_record_encryption key and internal token seeds; once compromised, it allows decrypting the entire GitLab database","Private SSH keys of GitLab CI\u002FCD runners — allow command execution on build agents and pivoting to deployment environments","CI\u002FCD tokens and environment variables stored in configuration — cloud keys, API keys, deployment secrets injected into pipelines","Database configuration files (database.yml) — host, port, database name, PostgreSQL connection credentials","Redis session data if the configuration points to an accessible Unix socket","Content of any file readable by the git system user in the instance tree",{"type":39,"title":53,"body":54},"Who is affected — and who is not","GitLab CE and EE versions from 18.7.0 to 19.3.1 inclusive are vulnerable, whether installed via omnibus packages, deployed as a Docker container, or deployed via Helm on Kubernetes. GitLab.com (the SaaS service hosted by GitLab Inc.) was patched upstream by the GitLab team before public disclosure — GitLab.com users are not affected and have no action to take. Only self-hosted instances are exposed. GitLab versions prior to 18.7 are not affected by this specific vector, but they are end-of-life and exposed to other unpatched vulnerabilities; upgrading to 19.3.2 is recommended in all cases. Instances isolated behind a firewall or VPN are not protected: the vector is standard HTTP on ports 80 and 443, internal network access or prior VPN compromise is sufficient to trigger exploitation.",{"type":56,"title":57,"steps":58},"steps","Patching GitLab CE\u002FEE to 19.3.2",[59,62,65,68],{"title":60,"body":61},"Back up the instance before any operation","Run a full backup: `sudo gitlab-backup create STRATEGY=copy`. Verify the archive is present in \u002Fvar\u002Fopt\u002Fgitlab\u002Fbackups\u002F and copy it to external storage. Do not skip this step even in an emergency — the patch modifies the database schema and a pre-patch backup is irreplaceable.",{"title":63,"body":64},"Stop GitLab and update the omnibus package","On Debian\u002FUbuntu: `sudo gitlab-ctl stop && sudo apt-get update && sudo apt-get install --only-upgrade gitlab-ee=19.3.2-ee.0 && sudo gitlab-ctl reconfigure && sudo gitlab-ctl start`. On RHEL\u002FCentOS: replace apt-get with `yum update gitlab-ee-19.3.2`. Verify the version after restart: `sudo gitlab-rake gitlab:env:info | grep GitLab`.",{"title":66,"body":67},"Update a Docker instance","Pull the new image: `docker pull gitlab\u002Fgitlab-ee:19.3.2-ee.0`. Stop the existing container: `docker stop gitlab`. Restart with the new image keeping mounted volumes: `docker run --detach --name gitlab --restart always -v \u002Fsrv\u002Fgitlab\u002Fconfig:\u002Fetc\u002Fgitlab -v \u002Fsrv\u002Fgitlab\u002Flogs:\u002Fvar\u002Flog\u002Fgitlab -v \u002Fsrv\u002Fgitlab\u002Fdata:\u002Fvar\u002Fopt\u002Fgitlab gitlab\u002Fgitlab-ee:19.3.2-ee.0`. Wait for the automatic reconfiguration to complete before testing access.",{"title":69,"body":70},"Verify post-update integrity","Run the built-in health checks: `sudo gitlab-rake gitlab:check SANITIZE=true` and `sudo gitlab-rake gitlab:doctor:secrets`. If either check reports an anomaly on secrets.yml, immediately perform the secret rotation described in the next section.",{"type":39,"title":72,"body":73},"Secret rotation after potential exposure","If your instance was exposed on the internet between the release of version 18.7 and the application of the patch — or if you have any doubt — secret rotation is mandatory. Patching stops future exploitation but does not revoke already exfiltrated credentials. Start by regenerating the database encryption key: `sudo gitlab-rake gitlab:encrypted_secrets:rotate_key`. Then revoke and regenerate all CI\u002FCD runner tokens from the administration interface (Admin > CI\u002FCD > Runners), then reconfigure each runner agent with the new token via `gitlab-runner register`. Replace SSH keys deployed on runners. Audit the CI\u002FCD variables of each project (Settings > CI\u002FCD > Variables) and change all deployment secrets — cloud API keys, Docker registry credentials, third-party service access tokens. Notify teams using CI\u002FCD pipelines on the instance that their deployment secrets should be considered compromised until proven otherwise.",{"type":43,"title":75,"items":76},"Post-patch checklist",[77,78,79,80,81,82,83],"Confirm installed version: `sudo gitlab-rake gitlab:env:info | grep 'GitLab version'` must show 19.3.2","Search for indicators of compromise in Nginx logs: request patterns containing `..\u002F` repeated or encoded (%2e%2e%2f) in \u002Fvar\u002Flog\u002Fgitlab\u002Fnginx\u002Fgitlab_access.log","Check for unexpected SSH connections in \u002Fvar\u002Flog\u002Fauth.log since the first 18.7 version was installed","Scan the instance with the detection tool published by watchTowr to confirm the vector is closed","Enable mandatory two-factor authentication for all administrator accounts if not already done","Verify HTTP security headers (HSTS, CSP) are correctly emitted after the update via `curl -I https:\u002F\u002Fyour-instance.example.com`","Schedule a security audit of repository permissions — successful exploitation may have created ghost administrator accounts",{"type":39,"title":85,"body":86},"Alternative: migrate to Gitea on VPS to reduce attack surface","GitLab CE is a complete Git forge but its monolithic architecture and large Ruby on Rails codebase mechanically expand the attack surface. CVE-2026-85706 is not an isolated incident: GitLab has had four critical CVEs (CVSS ≥ 9.0) over the past eighteen months. Gitea is a Go-based, single-binary alternative with a memory footprint roughly ten times smaller and a significantly shorter history of critical CVEs. For teams whose needs are limited to Git hosting, pull requests, webhooks, and lightweight CI integration, Gitea covers the essentials with a much smaller exposed surface. Migration involves exporting repositories, issues, wikis, and members from GitLab via the API, then importing them into Gitea — a process documented in the dedicated GitLab-to-Gitea migration article. On a VPS with root access, you retain full control over the update schedule, backups, and secret rotation, without depending on a third-party vendor to decide when your instance is patched.",{"type":56,"title":88,"steps":89},"Deploy Gitea on a ServOrbit VPS in 4 steps",[90,93,96,99],{"title":91,"body":92},"Provision a VPS and select the Gitea template","From the ServOrbit client portal, create a new VPS (minimum 2 vCPU, 2 GB RAM for a team of up to 20 developers) and select the Gitea application template. The template preconfigures Gitea with systemd, an Nginx reverse proxy with automatic TLS via Let's Encrypt, and daily backups to the object storage of your choice.",{"title":94,"body":95},"Configure the domain and TLS","Point your subdomain (e.g. git.your-domain.com) to the VPS IP via an A record in your DNS zone. The post-installation script detects the domain, requests a Let's Encrypt certificate via DNS-01 if you use Cloudflare, or HTTP-01 otherwise, and configures Nginx as HTTPS-only with HSTS.",{"title":97,"body":98},"Import repositories from GitLab","Gitea includes a migration wizard (Administration > Import repositories) that accepts your GitLab instance URL and a personal access token. It imports repositories, branches, tags, open issues, and wikis. For organizations with many projects, the `gitea-cli migrate` command-line tool allows bulk import automation.",{"title":100,"body":101},"Configure CI\u002FCD runners and revoke the old instance","Deploy Forgejo Actions or connect a Gitea Act runner on the same VPS or on a dedicated agent. Update deployment secrets in each migrated repository. Once pipelines are validated on Gitea, revoke the tokens on the old GitLab instance, disable runners, and schedule the uninstallation of GitLab to free up resources.",{"type":103,"body":104},"tip","For GitLab instances behind a VPN or internal network: do not defer the patch by assuming network isolation is sufficient. The CVE-2026-85706 vector is HTTP on ports 80 and 443 — any user with VPN access, any compromised workstation on the internal network, or any service that calls the GitLab API can trigger exploitation without any GitLab credentials. The CISA KEV confirms that malicious actors are actively targeting this vector, including in enterprise environments. The patch remains the only reliable remediation.",{"type":106,"title":107,"headers":108,"rows":112},"comparison","Self-hosted GitLab CE vs Gitea — security and operational criteria",[109,110,111],"Criterion","GitLab CE 19.x","Gitea 1.22.x",[113,117,121,125,128,131,135,139],[114,115,116],"Language \u002F architecture","Ruby on Rails + Go (hybrid)","Go — single binary",[118,119,120],"Minimum memory footprint","~2–4 GB RAM","~150–300 MB RAM",[122,123,124],"Critical CVEs (CVSS ≥ 9) over 18 months","4 including CVE-2026-85706","0",[126,127,127],"Built-in 2FA authentication","Yes",[129,130,130],"Control over patch schedule","You (self-hosted)",[132,133,134],"Already-patched SaaS available","GitLab.com (free tier)","Gitea Cloud (beta)",[136,137,138],"Native CI\u002FCD integration","GitLab CI (full-featured)","Gitea Actions \u002F Forgejo Actions",[140,141,142],"Migration from GitLab","N\u002FA","Built-in wizard + API",{"type":39,"title":144,"body":145},"Security lesson: managing your Git forge on a root-access VPS","CVE-2026-85706 illustrates a fundamental principle of self-hosted software security: the exposure window between the disclosure of a critical CVE and the application of the patch is the most dangerous period in an instance's life. On GitLab.com, this window was zero — the GitLab team patched silently before disclosure. On a self-hosted instance, the window depends entirely on your ability to be alerted, test, and deploy quickly. A VPS with root access gives you full control over this cycle: you can automate security updates with unattended-upgrades for system packages, set up CVE alerts via GitLab's security program RSS feeds, and test the patch on a staging environment before production. This control is also a responsibility: no cloud provider will patch your GitLab or Gitea instance for you. Best practice is to treat CVSS ≥ 9 CVEs as production incidents — remediation plan within 24 hours, secret rotation within 48 hours. On a ServOrbit VPS, automatic backups and direct root access allow you to meet this schedule without depending on a managed service whose timelines and procedures you do not control.","Deploy Gitea or GitLab on a root-access VPS","On a VPS with root access, patch GitLab or deploy Gitea via the ServOrbit template — secret rotation and updates remain under your control. No intermediary between you and your Git forge.","deploy","\u002Fvps-cloud",[151,173,193,210,231],{"id":152,"slug":153,"slugs":154,"title":158,"excerpt":159,"readTime":160,"views":18,"isPinned":19,"publishedAt":161,"updatedAt":162,"category":163,"categories":169,"featuredImage":30,"bgImage":31,"posterImage":171,"relatedSolution":172},352,"migrate-gitlab-to-gitea-vps-2026",{"fr":155,"en":153,"ar":156,"es":157},"migrer-gitlab-vers-gitea-vps-2026","الانتقال-من-gitlab-إلى-gitea-على-vps-في-2026","migrar-gitlab-a-gitea-en-un-vps-en-2026","Migrate from GitLab to Gitea on a VPS in 2026","GitLab.com made namespaces with more than 5 members read-only from August 15, 2026. Here is how to migrate to self-hosted Gitea without losing history.",10,"2026-09-16T00:00:00+00:00","2026-09-16T14:44:13+00:00",{"id":164,"name":165,"slug":166,"color":167,"icon":168},4,"Development","developpement","bg-warning\u002F10 text-warning","dev",[170],{"id":164,"name":165,"slug":166,"color":167,"icon":168},"\u002Fblog\u002Fcovers\u002Fmigrer-gitlab-vers-gitea-vps-2026-poster.svg",{"categorySlug":34,"appSlug":35},{"id":174,"slug":175,"slugs":176,"title":180,"excerpt":181,"readTime":182,"views":183,"isPinned":19,"publishedAt":184,"updatedAt":185,"category":186,"categories":190,"featuredImage":30,"bgImage":31,"posterImage":192,"relatedSolution":30},235,"install-gitlab-ce-on-a-vps-complete-guide",{"fr":177,"en":175,"ar":178,"es":179},"installer-gitlab-ce-vps","تثبيت-gitlab-ce-على-vps-دليل-شامل","instalar-gitlab-ce-en-un-vps-guia-completa","Install GitLab CE on a VPS: complete guide","Deploy GitLab CE on your VPS with Docker Compose: git forge, built-in CI\u002FCD, private Docker registry and project management — self-hosted.",17,3,"2026-08-07T00:00:00+00:00","2026-09-11T11:34:12+00:00",{"id":183,"name":187,"slug":188,"color":189,"icon":188},"Deployment","deploiement","bg-success\u002F10 text-success",[191],{"id":183,"name":187,"slug":188,"color":189,"icon":188},"\u002Fblog\u002Fcovers\u002Finstaller-gitlab-ce-vps-poster.svg",{"id":194,"slug":195,"slugs":196,"title":200,"excerpt":201,"readTime":202,"views":203,"isPinned":19,"publishedAt":204,"updatedAt":205,"category":206,"categories":207,"featuredImage":30,"bgImage":31,"posterImage":209,"relatedSolution":30},317,"linux-vps-hardening-checklist-for-agencies",{"fr":197,"en":195,"ar":198,"es":199},"linux-hardening-vps-checklist","قائمة-تصليب-خادم-لينكس-للوكالات-بعد-التسليم","hardening-linux-vps-checklist-para-agencias-tras-la-entrega","Linux VPS Hardening Checklist for Agencies","Reproducible Linux hardening checklist for agencies: auditd, sudo user, SSH key auth, UFW, fail2ban and root lockout — with per-client traceability.",11,1,"2026-08-30T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[208],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Flinux-hardening-vps-checklist-poster.svg",{"id":211,"slug":212,"slugs":213,"title":217,"excerpt":218,"readTime":160,"views":219,"isPinned":19,"publishedAt":220,"updatedAt":221,"category":222,"categories":227,"featuredImage":30,"bgImage":31,"posterImage":229,"relatedSolution":230},99,"gitea-vs-gitlab-which-self-hosted-git-forge-on-a-vps",{"fr":214,"en":212,"ar":215,"es":216},"gitea-vs-gitlab","gitea-مقابل-gitlab-أي-منصة-git-مستضافة-ذاتيا-على-vps","gitea-vs-gitlab-que-forja-git-self-hosted-en-vps","Gitea vs GitLab: Which Self-Hosted Git Forge on a VPS?","Gitea vs GitLab self-hosted in 2026: licenses, memory footprint, CI\u002FCD, migration and security compared to choose your Git forge on a VPS.",2,"2026-03-13T00:00:00+00:00","2026-09-19T17:11:18+00:00",{"id":223,"name":224,"slug":225,"color":226,"icon":225},5,"Comparison","comparatif","bg-info\u002F10 text-info",[228],{"id":223,"name":224,"slug":225,"color":226,"icon":225},"\u002Fblog\u002Fcovers\u002Fgitea-vs-gitlab-poster.svg",{"categorySlug":34,"appSlug":35},{"id":232,"slug":233,"slugs":234,"title":238,"excerpt":239,"readTime":160,"views":18,"isPinned":19,"publishedAt":240,"updatedAt":205,"category":241,"categories":242,"featuredImage":30,"bgImage":31,"posterImage":244,"relatedSolution":30},241,"gitea-forgejo-or-gitlab-ce-which-git-forge-in-2026",{"fr":235,"en":233,"ar":236,"es":237},"comparatif-forge-git-self-hosted-2026","gitea-أم-forgejo-أم-gitlab-ce-أي-منصة-git-في-2026","gitea-forgejo-o-gitlab-ce-que-forja-git-en-2026","Gitea, Forgejo or GitLab CE: Which Git Forge in 2026?","Gitea, Forgejo or GitLab CE for self-hosting your Git forge in 2026? Resources, CI\u002FCD, governance and migration after CVE-2026-59774.","2026-08-09T00:00:00+00:00",{"id":164,"name":165,"slug":166,"color":167,"icon":168},[243],{"id":164,"name":165,"slug":166,"color":167,"icon":168},"\u002Fblog\u002Fcovers\u002Fcomparatif-forge-git-self-hosted-2026-poster.svg",1789838184580]