CVE-2021-39935: GitLab CE/EE SSRF in CI Lint API

CVE-2021-39935 · Severity: critical · CVSS 7.5 · Exploited in the wild · Published 2026-02-03

GitLab Community and Enterprise Editions are widely used platforms for software development and version control. A security flaw in the CI Lint API allows unauthorized external users to trick the GitLab server into making network requests to internal or restricted systems. This could lead to the exposure of sensitive internal data or provide a foothold for further attacks within a corporate network.

Technologies: GitLab Community Edition, GitLab Enterprise Edition. Vendors: GitLab.

Quick answers

Is CVE-2021-39935 exploited in the wild?
Yes. CVE-2021-39935 is known to be exploited in the wild, first recorded on 3 February 2026. Treat it as urgent.
How severe is CVE-2021-39935?
Critical severity, with a CVSS score of 7.5, published 3 February 2026.
Which products and versions are affected?
GitLab Community Edition 10.5 to <14.3.6, 14.4 to <14.4.4, 14.5 to <14.5.2; GitLab Enterprise Edition 10.5 to <14.3.6, 14.4 to <14.4.4, 14.5 to <14.5.2.
Is there a fix for CVE-2021-39935?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-39935 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2021-39935?
Check whether you run GitLab Community, GitLab Community Edition, GitLab Enterprise Edition or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in GitLab CE/EE within the CI Lint API component. The flaw stems from insufficient validation of user-supplied URLs or inputs when the API processes CI configuration linting requests. An unauthenticated remote attacker can exploit this by sending crafted requests to the CI Lint API, forcing the GitLab server to initiate outbound requests to internal network resources or external services. This can be used to bypass firewalls, scan internal networks, or access sensitive metadata services. Patches are available in versions 14.3.6, 14.4.4, and 14.5.2.

Affected products

  • GitLab GitLab Community Edition 10.5 to <14.3.6, 14.4 to <14.4.4, 14.5 to <14.5.2
  • GitLab GitLab Enterprise Edition 10.5 to <14.3.6, 14.4 to <14.4.4, 14.5 to <14.5.2

Timeline

  • 2021-12-13: disclosed
  • 2021-12-13: advisory
  • 2026-02-03: kev added: Added to CISA KEV catalog due to evidence of active exploitation.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.