GitLab · Community and Enterprise Editions

CVE-2021-39935

GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

Exploited in attacks Medium 6.8 Attack chance: 36%

What it is

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API

CISA: GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: February 24, 2026

Added to the CISA list: February 3, 2026
Published: December 13, 2021
Severity: Medium 6.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 36% in the top 1.5% of all known vulnerabilities
Weakness: CWE-918
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from GitLab

Added	Vulnerability	Product	Severity	Attack chance
Nov 3, 2021	Remote Code ExecutionCVE-2021-22205used by ransomware	Community and Enterprise Editions	Critical 10.0	99.7%
Sep 11, 2026	Path TraversalCVE-2026-85706	Community Edition and Enterprise Edition	Critical 10.0	97%
Feb 18, 2026	Server-Side Request Forgery (SSRF)CVE-2021-22175	GitLab	Medium 6.8	53%
May 1, 2024	Community and Enterprise Editions Improper Access ControlCVE-2023-7028	GitLab CE/EE	Critical 10.0	94%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.