NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

GitLab server-request flaw CVE-2021-39935 used in attacks; fixes available since 2021

Attackers are exploiting an old GitLab server flaw to send requests into networks behind it. Organisations running affected Community or Enterprise Editions should upgrade to a supported release. Fixes first shipped in 14.3.6, 14.4.4 and 14.5.2.

What to do

Nothing for most families to install: this affects GitLab servers run by organisations. If your business or family office hosts GitLab, ask its IT team to upgrade to a currently supported release containing the fix and check for unexpected outbound requests.

What’s happening

CVE-2021-39935 affects older GitLab Community and Enterprise Edition servers. An outsider without a login can misuse CI Lint, the service that checks automated build configurations, to make GitLab send requests on their behalf, potentially reaching internal services. GitLab identifies affected releases from 10.5 onwards within three version ranges; fixes shipped in 14.3.6, 14.4.4 and 14.5.2 in December 2021. GreyNoise reported exploitation attempts in March 2025, before CISA confirmed active exploitation on 3 February 2026. As of 3 November 2026, the fix remains available, but the reviewed sources do not establish that attacks have ended or identify specific victims or losses. Ratings differ: GitLab’s JSON record gives 6.7, medium; NVD records GitLab’s score as 6.8 and assigns its own score of 7.5, high.

What
Flaw
Affects
GitLab Community Edition and Enterprise Edition servers
Affected
GitLab CE/EE >=10.5, <14.3.6
GitLab CE/EE >=14.4, <14.4.4
GitLab CE/EE >=14.5, <14.5.2
Fixed in
GitLab CE/EE 14.3.6
GitLab CE/EE 14.4.4
GitLab CE/EE 14.5.2
CVE
CVE-2021-39935
Since
3 Feb 2026
Closed
3 Feb 2026

Timeline

  1. CISA added

    CISA added CVE-2021-39935 to its Known Exploited Vulnerabilities catalogue based on evidence of active exploitation. US federal civilian agencies were given until 24 February to remediate.

  2. Wider attacks

    GreyNoise observed a surge of server-side request forgery attempts, including CVE-2021-39935. Its report counted about 400 attacking IP addresses across multiple flaws, not GitLab alone.

  3. New fixFixed

    GitLab released security updates 14.3.6, 14.4.4 and 14.5.2. These are the first fixed versions for CVE-2021-39935 in their respective release branches.

Sources

  1. GitLab’s CVE-2021-39935 recordGitLab · 13 Dec 2021
  2. GitLab Security Release: 14.5.2, 14.4.4, and 14.3.6 — Backport to 13.x?GitLab Forum · 7 Dec 2021
  3. New SSRF Exploitation Surge Serves as a Reminder of 2019 Capital One BreachGreyNoise · 11 Mar 2025
  4. CISA Adds Four Known Exploited Vulnerabilities to CatalogCISA · 3 Feb 2026
  5. CISA warns of five-year-old GitLab flaw exploited in attacksBleepingComputer · 4 Feb 2026
  6. CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV CatalogThe Hacker News · 4 Feb 2026
  7. CVE-2021-39935 DetailNIST NVD · 17 June 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS