How serious is CVE-2026-0602?

This vulnerability has a CVSS score of 4.3 out of 10, classified as MEDIUM severity. Proof-of-concept exploit code is publicly available, making this an active threat.

Is there exploit code available for CVE-2026-0602?

Yes, proof-of-concept exploit code for CVE-2026-0602 is publicly available on GitHub and security research platforms. This increases the risk of active exploitation.

Which products are affected by CVE-2026-0602?

CVE-2026-0602 affects gitlab gitlab. Check the full CVE details for specific version information.

How do I fix CVE-2026-0602?

To remediate CVE-2026-0602, check for security patches from gitlab. Apply all available updates and security patches. If no patch is available, implement recommended workarounds or security controls to mitigate the risk.

CVE-2026-0602

Medium

|4.3

Exploit Available

Plain English Summary

AI-powered analysis for quick understanding

An attacker with an authenticated account could potentially access sensitive metadata from private issues, merge requests, and other project elements due to a flaw in how GitLab handles snippets. This issue affects specific versions of GitLab and occurs under certain conditions when rendering snippets.

Technical Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering in the snippet rendering process under certain circumstances.

CVSS Vector Analysis

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredLow

User InteractionNone

Confidentiality ImpactLow

Integrity ImpactNone

Availability ImpactNone

ScopeUnchanged

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploit Resources

Search for proof-of-concept code and exploit modules

GitHub Search Exploit-DB Nuclei Templates Metasploit Vulners

Official References

NIST NVD

Est. Bounty

$552($500-$1K)

Vendor Response

Grade APatched in 6 days

Quick Information

Published

Mar 11, 2026

27 days ago

Last Modified

Mar 17, 2026

21 days ago

Vendor

gitlab

Product

gitlab

Related Vulnerabilities

CVE-2025-14513High

An attacker could exploit a flaw in GitLab's API to send specially crafted data that causes the system to crash, leading to a denial of service. This vulnerability affects specific versions of GitLab and can be triggered by anyone without needing to log in.

CVE-2025-13929High

This vulnerability allows an attacker to crash the GitLab service by sending specially crafted requests to certain repository archive endpoints, effectively causing a denial of service. It affects specific versions of GitLab, and the attacker does not need to be logged in to exploit it.

CVE-2025-13690Medium

This vulnerability allows an authenticated user to crash the GitLab server, leading to a denial of service, by sending specially crafted webhook header names. It affects specific versions of GitLab and requires the attacker to have access to an account on the system.

CVE-2025-12704Medium

An attacker could access sensitive Virtual Registry data from groups they don't belong to if they were already logged into GitLab, due to a flaw in the system's authorization checks. This issue affects specific versions of GitLab and requires the attacker to be an authenticated user.

CVE-2025-12697Medium

This vulnerability allows an attacker with maintainer permissions to potentially expose sensitive Datadog API credentials. It only affects specific versions of GitLab and requires the attacker to be logged in as a maintainer to exploit the issue.