Cloudflare WAF adds new rules for a GitLab vulnerability!
Hi everyone, it's Shii-chan! Today I'm sharing news about new rules landing in the Cloudflare WAF.
Cloudflare Changelog
developers.cloudflare.com
What was announced?
Cloudflare's Changelog published WAF Release 2026-09-30. It centers on new detection for a GitLab path traversal vulnerability, plus stronger generic rules against HTTP request smuggling, directory traversal, and command injection.
What changes
If you use the Cloudflare Managed Ruleset, a rules update helps you block attacks like these:
- Path traversal attacks against GitLab (CVE-2026-85706)
- Directory traversal that breaks access control
- Attacks that abuse request routing cache inconsistency
You don't have to research the vulnerability and write a custom rule yourself, because the managed rules cover it first!
Dive Deep
Here are the five rules that changed:
- Broken Access Control - Directory Traversal (new detection): previous action Log, new action Block
- HTTP Request Smuggling - Request Body Anomaly - Beta: Log to Block. Merged into the original "HTTP/2 Request Smuggling - Request Body Anomaly"
- Command Injection - Generic 8 - body - Beta: stays Disabled. Merged into the original "Command Injection - Generic 8 - body"
- GitLab - Path Traversal - CVE:CVE-2026-85706 (new detection): Log to Block
- Generic - Request routing cache inconsistency (new detection): Block
The merged rules are consolidated into their original rules. The rule ID suffixes are listed in the Changelog, so compare them with your own ruleset.
Wrap-up
- New detection for GitLab path traversal CVE-2026-85706
- New generic rules for directory traversal and cache inconsistency
- Request smuggling and command injection rules were merged into existing rules
- Most new and changed rules act as Block
This is great for anyone protecting GitLab behind Cloudflare WAF, and for security folks who want to track rule changes carefully!
