widely-deployed-product-advisoryinternet-facing-service-vulnerabilityidentity-authentication-vulnerabilityendpoint-software-vulnerability

GitLab Security Update Fixes Web IDE Token Theft and DoS Vulnerabilities

Patch & Detection Intelligence · 5 sources · Updated 4mo ago · First seen Feb 11, 2026

GitLab released security updates for Community Edition (CE) and Enterprise Edition (EE), shipping patched versions 18.8.4, 18.7.4, and 18.6.6 for self-managed deployments (with GitLab.com already remediated). The most severe issue, CVE-2025-7659 (CVSS 8.0), was attributed to incomplete validation in the Web IDE that could allow an unauthenticated attacker to steal access tokens and use them to access private repositories.

The same release also addressed multiple high-severity availability and client-side issues, including CVE-2025-8099 (CVSS 7.5) enabling DoS via repeated/complex GraphQL queries and CVE-2026-0958 (CVSS 7.5) enabling resource exhaustion by bypassing JSON validation middleware limits. Additional fixes included CPU-exhaustion vectors involving specially crafted Markdown processing (e.g., CVE-2026-1456 and CVE-2026-1458) and an XSS issue in code flow functionality (CVE-2025-14560, CVSS 7.3) that could enable malicious script execution in a victim’s browser session.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Feb 10, 2026 – Feb 13, 2026

Feb 13, 20269mo ago
Belgium CCB warns of multiple high-criticality GitLab vulnerabilities
On 2026-02-13, Belgium's Centre for Cybersecurity published an advisory warning about multiple high-criticality vulnerabilities in GitLab CE/EE and calling for immediate patching. This reflects broader government amplification of GitLab's February 10 security release.
Feb 11, 20269mo ago
Canadian Centre for Cyber Security urges users to apply GitLab updates
On 2026-02-11, the Canadian Centre for Cyber Security issued advisory AV26-114 referencing GitLab's February 10 security advisory. It urged users and administrators to review GitLab's guidance and apply patch versions 18.8.4, 18.7.4, and 18.6.6.
Feb 10, 20269mo ago
GitLab discloses CVE-2025-7659 and other key flaws in advisory
GitLab's advisory identified CVE-2025-7659 as the most severe issue, a Web IDE incomplete validation flaw that could let an unauthenticated attacker steal access tokens and access private repositories. The advisory also described additional DoS, XSS, HTML injection, and related vulnerabilities, and noted GitLab.com was already patched while some self-managed upgrades may involve database-migration downtime.
Feb 10, 20269mo ago
GitLab releases security patches for CE and EE vulnerabilities
On 2026-02-10, GitLab published patch releases 18.8.4, 18.7.4, and 18.6.6 for Community Edition and Enterprise Edition, urging self-managed customers to upgrade immediately. The fixes addressed 13 vulnerabilities, including high-severity issues affecting the Web IDE, denial-of-service conditions, XSS, HTML injection, SSRF, and other validation and authorization flaws.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Incomplete Validation in GitLab Web IDE (CVE-2025-7659)

Affected products

2 linked

Gitlab Community EditionGitlab Enterprise Edition

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

Belgium Ccb Security AdvisoriesNews · Feb 13, 2026

Warning: Multiple high criticality vulnerabilities in GitLab CC/EE, Patch Immediately! | CCB SafeonwebOpen source ↗

Ca CcsNews · Feb 11, 2026

GitLab security advisory (AV26-114) - Canadian Centre for Cyber SecurityOpen source ↗

Cyber Security NewsNews · Feb 11, 2026

GitLab Patches Multiple Vulnerabilities That Enables DoS and Cross-site Scripting AttacksOpen source ↗

Security Online InfoNews · Feb 11, 2026

GitLab Patch Alert: High-Severity Web IDE Flaw Exposes Private ReposOpen source ↗

Gitlab ReleasesNews · Feb 10, 2026

GitLab Patch Release: 18.8.4, 18.7.4, 18.6.6 | GitLabOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

widely-deployed-product-advisoryinternet-facing-service-vulnerabilityidentity-authentication-vulnerabilityendpoint-software-vulnerability

GitLab Security Update Fixes Web IDE Token Theft and DoS Vulnerabilities

Patch & Detection Intelligence · 5 sources · Updated 4mo ago · First seen Feb 11, 2026

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Feb 10, 2026 – Feb 13, 2026

Feb 13, 20269mo ago
Belgium CCB warns of multiple high-criticality GitLab vulnerabilities
On 2026-02-13, Belgium's Centre for Cybersecurity published an advisory warning about multiple high-criticality vulnerabilities in GitLab CE/EE and calling for immediate patching. This reflects broader government amplification of GitLab's February 10 security release.
Feb 11, 20269mo ago
Canadian Centre for Cyber Security urges users to apply GitLab updates
On 2026-02-11, the Canadian Centre for Cyber Security issued advisory AV26-114 referencing GitLab's February 10 security advisory. It urged users and administrators to review GitLab's guidance and apply patch versions 18.8.4, 18.7.4, and 18.6.6.
Feb 10, 20269mo ago
GitLab discloses CVE-2025-7659 and other key flaws in advisory
GitLab's advisory identified CVE-2025-7659 as the most severe issue, a Web IDE incomplete validation flaw that could let an unauthenticated attacker steal access tokens and access private repositories. The advisory also described additional DoS, XSS, HTML injection, and related vulnerabilities, and noted GitLab.com was already patched while some self-managed upgrades may involve database-migration downtime.
Feb 10, 20269mo ago
GitLab releases security patches for CE and EE vulnerabilities
On 2026-02-10, GitLab published patch releases 18.8.4, 18.7.4, and 18.6.6 for Community Edition and Enterprise Edition, urging self-managed customers to upgrade immediately. The fixes addressed 13 vulnerabilities, including high-severity issues affecting the Web IDE, denial-of-service conditions, XSS, HTML injection, SSRF, and other validation and authorization flaws.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Incomplete Validation in GitLab Web IDE (CVE-2025-7659)

Affected products

2 linked

Gitlab Community EditionGitlab Enterprise Edition

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

Belgium Ccb Security AdvisoriesNews · Feb 13, 2026

Warning: Multiple high criticality vulnerabilities in GitLab CC/EE, Patch Immediately! | CCB SafeonwebOpen source ↗

Ca CcsNews · Feb 11, 2026

GitLab security advisory (AV26-114) - Canadian Centre for Cyber SecurityOpen source ↗

Cyber Security NewsNews · Feb 11, 2026

GitLab Patches Multiple Vulnerabilities That Enables DoS and Cross-site Scripting AttacksOpen source ↗

Security Online InfoNews · Feb 11, 2026

GitLab Patch Alert: High-Severity Web IDE Flaw Exposes Private ReposOpen source ↗

Gitlab ReleasesNews · Feb 10, 2026

GitLab Patch Release: 18.8.4, 18.7.4, 18.6.6 | GitLabOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

GitLab Security Update Fixes Web IDE Token Theft and DoS Vulnerabilities

How this story unfolded

Belgium CCB warns of multiple high-criticality GitLab vulnerabilities

Canadian Centre for Cyber Security urges users to apply GitLab updates

GitLab discloses CVE-2025-7659 and other key flaws in advisory

GitLab releases security patches for CE and EE vulnerabilities

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches token theft, DoS, XSS, SSRF, and auth bypass flaws

GitLab Patches XSS and API Denial-of-Service Vulnerabilities in CE/EE

GitLab Security Patches Fix High-Severity WebSocket and DoS Flaws

GitLab Security Update Fixes Web IDE Token Theft and DoS Vulnerabilities

How this story unfolded

Belgium CCB warns of multiple high-criticality GitLab vulnerabilities

Canadian Centre for Cyber Security urges users to apply GitLab updates

GitLab discloses CVE-2025-7659 and other key flaws in advisory

GitLab releases security patches for CE and EE vulnerabilities

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches token theft, DoS, XSS, SSRF, and auth bypass flaws

GitLab Patches XSS and API Denial-of-Service Vulnerabilities in CE/EE

GitLab Security Patches Fix High-Severity WebSocket and DoS Flaws