GitLab CI Lint API SSRF (CVE-2021-39935)

Historical catalog analysis: CISA added this entry on February 03, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2021-39935 is a Server-Side Request Forgery (SSRF) vulnerability identified in both the Community and Enterprise Editions of GitLab. The flaw resides within the CI Lint API, which could allow unauthorized external users to induce the server to perform requests to arbitrary destinations.

Exposure and applicability

This vulnerability applies to organizations running affected versions of GitLab Community or Enterprise Editions that have the CI Lint API exposed to untrusted networks. Because this vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, it is categorized as a flaw with evidence of active exploitation in the wild, increasing the urgency for infrastructure owners to identify and remediate affected assets.

Remediation priorities

Based on the reported exposure path, we analyze the following prioritization for vulnerability management teams:

1. Asset Identification: Identify all GitLab instances (Community and Enterprise) across the environment. Priority should be given to those with public-facing interfaces or those residing in network segments where the CI Lint API is accessible to unauthorized users.
2. Vendor Mitigation Application: Apply the mitigations provided by the vendor. For federal agencies, CISA has established a remediation deadline of February 24, 2026.
3. Service Decommissioning: In scenarios where vendor-supplied mitigations cannot be applied or are unavailable for a specific legacy version, the source indicates that discontinuing use of the product is a necessary alternative to eliminate the risk.

How to validate remediation

Verification must move beyond simple version checks, as a deployed patch does not always guarantee that the configuration is secure. To verify that exposure has been reduced, defenders should focus on the behavior of the CI Lint API:

• Functional Validation: Confirm that the CI Lint API no longer processes requests to unauthorized external or internal destinations.
• Network Egress Analysis: Review egress logs from the GitLab server to ensure no unexpected outbound requests are being initiated via the API service following the update.
• Configuration Audit: Verify that any compensating network controls (such as firewall rules or proxy restrictions) intended to limit the API’s reach are active and correctly scoped.

Limits and open questions

While the entry path is identified as the CI Lint API, the source does not specify the exact internal targets an attacker might pursue once the SSRF is triggered. Additionally, it remains unknown whether this vulnerability has been utilized in known ransomware campaigns. There is a residual risk that other undocumented paths to the same underlying flaw may exist or that network-level mitigations may be bypassed if not strictly implemented.

Source and editorial note

CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability · Source date: February 03, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 06, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 22, 2026 at 00:21 UTC.

Request a Vulnerability Assessment