CVE-2021-39935: GitLab CI Lint API server-side request forgery

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely reachable without authentication, has high confidentiality impact, and is listed in CISA KEV with elevated EPSS, though it is not tied to ransomware.

What it is

GitLab CE/EE contains a server-side request forgery flaw in the CI Lint API affecting versions from 10.5 before 14.3.6, 14.4 before 14.4.4, and 14.5 before 14.5.2. Unauthorized external users can make the GitLab server issue requests to attacker-chosen destinations, which matters because the server may reach internal services that are not otherwise exposed.

Impact

An attacker gains the ability to send requests from the GitLab server to internal or otherwise unreachable systems, with high confidentiality impact per the CVSS vector. There is no integrity or availability impact in the stated vector.

Attack surface

Reached over the network through the CI Lint API; the CVSS vector shows no privileges required and no user interaction, and the description states unauthorized external users can trigger it.

Exploitation

CVE-2021-39935 is listed in CISA KEV with a due date of 2026-02-24, and EPSS shows a 30-day probability of 0.35649 (98.4th percentile), indicating meaningful exploitation activity. No ransomware campaign use is documented.

What to do

• Upgrade GitLab CE/EE to 14.3.6, 14.4.4, 14.5.2 or later as applicable to your release line.
• If immediate patching is not possible, restrict or disable external access to the CI Lint API and follow the vendor's mitigation guidance referenced in the CISA KEV entry.
• Limit outbound network access from GitLab servers so they cannot reach internal metadata services, admin interfaces or other sensitive internal endpoints.
• Review GitLab instance exposure to the internet and reduce it where the CI Lint API does not need to be publicly reachable.

Detection

• Monitor GitLab server outbound connections for requests to internal RFC1918 addresses, loopback or cloud metadata endpoints originating from the GitLab process.
• Review GitLab and reverse proxy logs for CI Lint API requests from unauthenticated or unexpected external sources.
• Alert on unusual or repeated CI Lint API calls that correlate with outbound connection attempts to non-GitLab destinations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.