{"id":"gitlab-ci-lint-ssrf-attacks-feb-2026","category":"patch","status":"closed","title":"GitLab server-request flaw CVE-2021-39935 used in attacks; fixes available since 2021","tldr":"Attackers are exploiting an old GitLab server flaw to send requests into networks behind it. Organisations running affected Community or Enterprise Editions should upgrade to a supported release. Fixes first shipped in 14.3.6, 14.4.4 and 14.5.2.","summary":"CVE-2021-39935 affects older GitLab Community and Enterprise Edition servers. An outsider without a login can misuse CI Lint, the service that checks automated build configurations, to make GitLab send requests on their behalf, potentially reaching internal services. GitLab identifies affected releases from 10.5 onwards within three version ranges; fixes shipped in 14.3.6, 14.4.4 and 14.5.2 in December 2021. GreyNoise reported exploitation attempts in March 2025, before CISA confirmed active exploitation on 3 February 2026. As of 3 November 2026, the fix remains available, but the reviewed sources do not establish that attacks have ended or identify specific victims or losses. Ratings differ: GitLab’s JSON record gives 6.7, medium; NVD records GitLab’s score as 6.8 and assigns its own score of 7.5, high.","action":"Nothing for most families to install: this affects GitLab servers run by organisations. If your business or family office hosts GitLab, ask its IT team to upgrade to a currently supported release containing the fix and check for unexpected outbound requests.","product":"GitLab Community Edition and Enterprise Edition servers","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2021-39935"],"tags":["gitlab","ssrf","actively-exploited","self-hosted","server"],"affected":["GitLab CE/EE >=10.5, <14.3.6","GitLab CE/EE >=14.4, <14.4.4","GitLab CE/EE >=14.5, <14.5.2"],"fixed":["GitLab CE/EE 14.3.6","GitLab CE/EE 14.4.4","GitLab CE/EE 14.5.2"],"matches":[],"sources":[{"kind":"advisory","title":"GitLab’s CVE-2021-39935 record","url":"https://gitlab.com/gitlab-org/cves/-/raw/master/2021/CVE-2021-39935.json","by":"GitLab","date":"2021-12-13"},{"kind":"post","title":"GitLab Security Release: 14.5.2, 14.4.4, and 14.3.6 — Backport to 13.x?","url":"https://forum.gitlab.com/t/gitlab-security-release-14-5-2-14-4-4-and-14-3-6-backport-to-13-x/62532","by":"GitLab Forum","date":"2021-12-07"},{"kind":"research","title":"New SSRF Exploitation Surge Serves as a Reminder of 2019 Capital One Breach","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","by":"GreyNoise","date":"2025-03-11"},{"kind":"advisory","title":"CISA Adds Four Known Exploited Vulnerabilities to Catalog","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40778cf","by":"CISA","date":"2026-02-03"},{"kind":"news","title":"CISA warns of five-year-old GitLab flaw exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-five-year-old-gitlab-flaw-exploited-in-attacks/","by":"BleepingComputer","date":"2026-02-04"},{"kind":"news","title":"CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog","url":"https://thehackernews.com/2026/02/cisa-adds-actively-exploited-solarwinds.html","by":"The Hacker News","date":"2026-02-04"},{"kind":"advisory","title":"CVE-2021-39935 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2021-39935","by":"NIST NVD","date":"2026-06-17"}],"started":"2026-02-03","closed":"2026-02-03","created":"2026-11-03T22:33:48.296Z","updated":"2026-11-03T22:33:48.296Z","cve_notes":[{"cve":"CVE-2021-39935","name":"Server-side request forgery in GitLab CI Lint API","what":"Missing access restrictions in GitLab’s CI Lint API allow unauthorised external users to make the server send requests on their behalf, potentially exposing internal services.","severity":"medium","cvss":6.7}],"timeline":[{"at":"2026-02-03","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2021-39935 to its Known Exploited Vulnerabilities catalogue based on evidence of active exploitation. US federal civilian agencies were given until 24 February to remediate.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40778cf","by":"CISA","patch":null},{"at":"2025-03-09","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"GreyNoise observed a surge of server-side request forgery attempts, including CVE-2021-39935. Its report counted about 400 attacking IP addresses across multiple flaws, not GitLab alone.","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","by":"GreyNoise","patch":null},{"at":"2021-12-06","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"GitLab released security updates 14.3.6, 14.4.4 and 14.5.2. These are the first fixed versions for CVE-2021-39935 in their respective release branches.","url":"https://forum.gitlab.com/t/gitlab-security-release-14-5-2-14-4-4-and-14-3-6-backport-to-13-x/62532","by":"GitLab Forum","patch":"patched"}],"url":"https://hard.fyi/live/gitlab-ci-lint-ssrf-attacks-feb-2026/","json":"https://hard.fyi/api/live?id=gitlab-ci-lint-ssrf-attacks-feb-2026"}