medium6.8Known exploited

CVE-2021-39935

GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

Exploited in the wild

This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-02-03. Federal due date: 2026-02-24.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Impact

GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.

Affected products

Vendor	Product	Affected versions
Gitlab	Gitlab	from 10.5.0 before 14.3.6 from 14.4.0 before 14.4.4 from 14.5.0 before 14.5.2

Weakness classification

CWE-918

References

NVD record
CVE.org record
CISA KEV catalog
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39935.json
https://gitlab.com/gitlab-org/gitlab/-/issues/346187
https://hackerone.com/reports/1236965
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39935