What’s Vulnerable › Vulnerabilities

CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-02-03
• EPSS: 36.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-13 · updated 2026-06-17
• Weakness: CWE-918

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API

Affected products

• GitLab: from 10.5.0 before 14.3.6; from 14.4.0 before 14.4.4; from 14.5.0 before 14.5.2 — fixed in 14.3.6, 14.4.4, 14.5.2

How to fix

Upgrade to a fixed version: GitLab 14.3.6, 14.4.4, 14.5.2. Check the vendor advisory for mitigations.

References

• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39935.json
• https://gitlab.com/gitlab-org/gitlab/-/issues/346187
• https://hackerone.com/reports/1236965
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39935.json
• https://gitlab.com/gitlab-org/gitlab/-/issues/346187
• https://hackerone.com/reports/1236965
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39935

Get alerted when CVE-2021-39935 or the next vulnerability affects your stack