CVE-2026-85706 GitLab Validation Lab

This directory builds an isolated, local-only GitLab lab for authorized defensive testing of CVE-2026-85706. The CVE affects GitLab CE/EE repository-commits API path confinement and authentication enforcement. It uses a full Ubuntu guest.

Safety and scope

• Use only on a machine you own or are explicitly authorized to test.
• The vulnerable profile is intentionally unpatched. Do not expose it to a LAN, VPN, cloud address, or the public Internet.
• The Vagrantfile forwards GitLab only to 127.0.0.1:8443 on the host by default (customizable with LAB_HTTPS_PORT) and uses a host-only guest address.
• The included checks are non-destructive health and authentication checks. They do not include a file-read payload, exploit chain, persistence, or evasion logic.
• Destroy the lab when finished with ./scripts/teardown-vm.sh.

Prerequisites

• VirtualBox 7.x and Vagrant 2.x
• At least 8 GB RAM available for the VM
• curl, openssl, and bash
• Approximately 12 GB of free disk space

Build and run

cd ~/gitlab-cve-lab
./scripts/setup-vm.sh

The setup script creates a VM, installs GitLab CE directly from the official package repository, and waits for the health endpoint. Open the lab at https://127.0.0.1:8443 (the browser will warn about the local certificate). Use LAB_HTTPS_PORT and LAB_SSH_PORT when the defaults are unavailable.

The default profile is vulnerable, pinned to GitLab CE 19.3.1-ce.0, which is in the affected range published for CVE-2026-85706. To build the patched comparison profile, run:

LAB_PROFILE=patched ./scripts/setup-vm.sh

The patched profile uses GitLab CE 19.3.2-ce.0. If the package repository no longer offers that exact version, set GITLAB_VERSION to a vendor-provided patched version before running setup.

Validation

./scripts/smoke-test-vm.sh

The smoke test verifies VM health, local-only port reachability, and that an unauthenticated request to the repository-commits API is not treated as an authenticated file-reading operation. It intentionally does not attempt to retrieve arbitrary files.

For a controlled authenticated test, create a disposable private project in the GitLab UI, add a test commit, and use only paths within that project. Record timestamps and HTTP status codes, not sensitive file contents.

Teardown

./scripts/teardown-vm.sh

This powers off and destroys the VM, its attached disk, and its generated certificate.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85706
• GitLab security advisories: https://about.gitlab.com/releases/categories/releases/
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exercise materials

• Architecture
• Learning objectives
• Build guide
• Safe walkthrough
• Student exercise
• Instructor guide
• Answer key
• Monitoring exercise
• Remediation exercise
• Evidence template
• Checklist
• Grading rubric
• Troubleshooting
• Report template
• Dependency manifest
• Security policy
• Stretch goals
• Exercise questions
• Version matrix
• Mock scenario: Project Lantern

License

This project is available under the MIT License. Responsible-use requirements for the vulnerable lab are documented in the license agreement and security policy.