CVE-2021-39935mediumunder attackCWE-918

CVE-2021-39935: medium-severity vulnerability in GitLab

Published · Updated

Follow this CVE+ Monitor GitLab+ Monitor GitLab Community and Enterprise Editions

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

55Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 6.8epss 36%
from disclosure to weapon
Published on NVDDec 13
CISA KEV+1513d
Action required by CISAfederal deadline: 2026-02-24

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

GitLab's CI Lint API allows unauthorized external users to make server-side requests to internal systems. This could let attackers access private resources or internal services that should not be exposed.

Technical detail

Server-Side Request Forgery (SSRF) vulnerability in GitLab CI Lint API (CWE-918) affecting versions 10.5–14.3.5, 14.4–14.4.3, and 14.5–14.5.1. Unauthenticated attackers can craft malicious CI configuration inputs to trigger unauthorized HTTP requests from the GitLab server to internal or external targets, potentially exposing sensitive data or compromising internal services.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
GitLab · GitLab
Related CVEs — GitLab

In the same product, most dangerous first.

CVE-2021-22205CRITICALCVE-2021-22205EPSS 99.7%KEVCVE-2026-85706CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabEPSS 97.4%KEVCVE-2023-7028CRITICALWeak Password Recovery Mechanism for Forgotten Password in GitLabEPSS 94.5%KEVCVE-2026-97229CRITICALInteger Overflow or Wraparound in GitLabEPSS 65.2%KEVCVE-2021-22175MEDIUMCVE-2021-22175EPSS 53.4%KEVCVE-2023-2442HIGHCVE-2023-2442EPSS 96.1%