Today, I got positively surprised by German civil servants. Which is weird. Most of the time there are negative surprises.

I incorporated two legal entities in Germany and therefore am no stranger to slow annoying and burdensome bureaucracy. Furthermore, I’ve built a digital health app and launched another application handling health data recently, which makes me intricately familiar with data privacy regulation.

(Contrary to the prevailing opinion of most tech people I genuinely support that regulation. For most people it seems to be a ‘you are holding it wrong’ situation. I digress…)

Coming to today: I got an email from the Federal Office for Information Security (BSI) forwarded through the Hetzner Abuse team. That combination alone sent a cold shiver down my neck.

No complaints though! They informed me that I was running an outdated version of GitLab CE, which under some circumstances allowed unauthenticated file access (release notes). That’s impressive! The version got released 13 days ago, and I was running the previous patch release not some random ancient version.

Thank you BSI, please keep up the good work!

bsi-email.eml (IP redacted)
Dear Sir or Madam,

a critical vulnerability in GitLab CE/EE (CVE-2026-85706) can be exploited by an
unauthenticated remote attacker to read arbitrary files from the GitLab server.

The vendor released versions 19.3.2, 19.2.6 and 19.1.8 fixing this vulnerability.

The vendor strongly recommends that all self-managed GitLab installations
be upgraded to one of these versions immediately.

Additional information provided by the vendor:
<https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/>

Please find below a list of IP addresses of GitLab servers on your networks
found to be running a version affected by this vulnerability.
All timestamps are UTC.

We would like to ask you to take appropriate steps to secure affected systems
or notify your customers accordingly.

This message is digitally signed using PGP.
Information on the signature key is available at:
<https://reports.cert-bund.de/en/digital-signature>

Please note:
This is an automatically generated message. Replies to the
sender address <reports@reports.cert-bund.de> will NOT be read
but silently be discarded. In case of questions, please contact
<certbund@bsi.bund.de> and keep the ticket number [CB-Report#...]
of this message in the subject line.

Affected systems on your network:

Format: ASN | IP | Timestamp (UTC) | Port | Version | Cve
24940 | 000.000.000.000 | 2026-09-22 19:36:31 | 443 | 19.3.1 | cve-2026-85706

Mit freundlichen Grüßen / Kind regards
Team CERT-Bund

Bundesamt für Sicherheit in der Informationstechnik
Federal Office for Information Security (BSI)
CERT-Bund
Godesberger Allee 87, 53175 Bonn, Germany