_________________________/\\\\\\\\\\\______________________________________________________________________________________________________________________________________ _______________________/\\\/////////\\\____________________________________________________________________________________________________________________________________ ______________________\//\\\______\///____________________________________________________________/\\\_____/\\\_________/\\\__/\\\_________________________________________ _______________________\////\\\_____________/\\\\\\\\______/\\\\\\\\__/\\\____/\\\__/\\/\\\\\\\__\///___/\\\\\\\\\\\___\//\\\/\\\__________________________________________ __________________________\////\\\________/\\\/////\\\___/\\\//////__\/\\\___\/\\\_\/\\\/////\\\__/\\\_\////\\\////_____\//\\\\\___________________________________________ _____________________________\////\\\____/\\\\\\\\\\\___/\\\_________\/\\\___\/\\\_\/\\\___\///__\/\\\____\/\\\__________\//\\\____________________________________________ ______________________/\\\______\//\\\__\//\\///////___\//\\\________\/\\\___\/\\\_\/\\\_________\/\\\____\/\\\_/\\___/\\_/\\\_____________________________________________ _____________________\///\\\\\\\\\\\/____\//\\\\\\\\\\__\///\\\\\\\\_\//\\\\\\\\\__\/\\\_________\/\\\____\//\\\\\___\//\\\\/______________________________________________ _______________________\///////////_______\//////////_____\////////___\/////////___\///__________\///______\/////_____\////________________________________________________ _____________________________________________/\\\\\\\\\\\__________________/\\\_______________________________________________________________________________________________________ ___________________________________________/\\\/////////\\\_______________\/\\\_______________________________________________________________________________________________________ __________________________________________\//\\\______\///________________\/\\\_________________________/\\\_______________________________________/\\\_______________________________ ___________________________________________\////\\\__________/\\\____/\\\_\/\\\_________/\\\\\\\\\\__/\\\\\\\\\\\__/\\/\\\\\\\___/\\\\\\\\\_____/\\\\\\\\\\\_____/\\\\\\\\____________ ______________________________________________\////\\\______\/\\\___\/\\\_\/\\\\\\\\\__\/\\\//////__\////\\\////__\/\\\/////\\\_\////////\\\___\////\\\////____/\\\/////\\\___________ _________________________________________________\////\\\___\/\\\___\/\\\_\/\\\////\\\_\/\\\\\\\\\\____\/\\\______\/\\\___\///____/\\\\\\\\\\_____\/\\\_______/\\\\\\\\\\\____________ __________________________________________/\\\______\//\\\__\/\\\___\/\\\_\/\\\__\/\\\_\////////\\\____\/\\\_/\\__\/\\\__________/\\\/////\\\_____\/\\\_/\\__\//\\///////_____________ _________________________________________\///\\\\\\\\\\\/___\//\\\\\\\\\__\/\\\\\\\\\___/\\\\\\\\\\____\//\\\\\___\/\\\_________\//\\\\\\\\/\\____\//\\\\\____\//\\\\\\\\\\___________ ___________________________________________\///////////______\/////////___\/////////___\//////////______\/////____\///___________\////////\//______\/////______\//////////____________
_________________________/\\\\\\\\\\\______________________________________________________________________________________________________________________________________ _______________________/\\\/////////\\\____________________________________________________________________________________________________________________________________ ______________________\//\\\______\///____________________________________________________________/\\\_____/\\\_________/\\\__/\\\_________________________________________ _______________________\////\\\_____________/\\\\\\\\______/\\\\\\\\__/\\\____/\\\__/\\/\\\\\\\__\///___/\\\\\\\\\\\___\//\\\/\\\__________________________________________ __________________________\////\\\________/\\\/////\\\___/\\\//////__\/\\\___\/\\\_\/\\\/////\\\__/\\\_\////\\\////_____\//\\\\\___________________________________________ _____________________________\////\\\____/\\\\\\\\\\\___/\\\_________\/\\\___\/\\\_\/\\\___\///__\/\\\____\/\\\__________\//\\\____________________________________________ ______________________/\\\______\//\\\__\//\\///////___\//\\\________\/\\\___\/\\\_\/\\\_________\/\\\____\/\\\_/\\___/\\_/\\\_____________________________________________ _____________________\///\\\\\\\\\\\/____\//\\\\\\\\\\__\///\\\\\\\\_\//\\\\\\\\\__\/\\\_________\/\\\____\//\\\\\___\//\\\\/______________________________________________ _______________________\///////////_______\//////////_____\////////___\/////////___\///__________\///______\/////_____\////________________________________________________ _____________________________________________/\\\\\\\\\\\__________________/\\\_______________________________________________________________________________________________________ ___________________________________________/\\\/////////\\\_______________\/\\\_______________________________________________________________________________________________________ __________________________________________\//\\\______\///________________\/\\\_________________________/\\\_______________________________________/\\\_______________________________ ___________________________________________\////\\\__________/\\\____/\\\_\/\\\_________/\\\\\\\\\\__/\\\\\\\\\\\__/\\/\\\\\\\___/\\\\\\\\\_____/\\\\\\\\\\\_____/\\\\\\\\____________ ______________________________________________\////\\\______\/\\\___\/\\\_\/\\\\\\\\\__\/\\\//////__\////\\\////__\/\\\/////\\\_\////////\\\___\////\\\////____/\\\/////\\\___________ _________________________________________________\////\\\___\/\\\___\/\\\_\/\\\////\\\_\/\\\\\\\\\\____\/\\\______\/\\\___\///____/\\\\\\\\\\_____\/\\\_______/\\\\\\\\\\\____________ __________________________________________/\\\______\//\\\__\/\\\___\/\\\_\/\\\__\/\\\_\////////\\\____\/\\\_/\\__\/\\\__________/\\\/////\\\_____\/\\\_/\\__\//\\///////_____________ _________________________________________\///\\\\\\\\\\\/___\//\\\\\\\\\__\/\\\\\\\\\___/\\\\\\\\\\____\//\\\\\___\/\\\_________\//\\\\\\\\/\\____\//\\\\\____\//\\\\\\\\\\___________ ___________________________________________\///////////______\/////////___\/////////___\//////////______\/////____\///___________\////////\//______\/////______\//////////____________
cve

CVE-2021-39935: GitLab SSRF Now Actively Exploited

Security Substrate

— 6 min read

CVE-2021-39935: GitLab SSRF Now Actively Exploited

CVE ID: CVE-2021-39935

Severity: MEDIUM | CVSS: 6.8

Sources: 2 different security sources

Status: ACTIVELY EXPLOITED - Added to CISA KEV Catalog

Let Me Explain What Happened

My friends, we need to talk about a GitLab vulnerability that's been around since 2021 but has recently taken a concerning turn. On February 3, 2026, CISA added CVE-2021-39935 to their Known Exploited Vulnerabilities catalog, which means attackers are actively using this weakness in the wild right now. This is a Server-Side Request Forgery (SSRF) vulnerability in GitLab's CI Lint API that allows unauthorized external users to make your GitLab server perform requests on their behalf—essentially tricking your trusted server into doing things it shouldn't.

Think of it like this: imagine someone convincing your trusted assistant to fetch documents from locked filing cabinets and hand them over, even though that person has no authorization to see those documents. That's essentially what's happening here, and it's why CISA is treating this with urgency despite the "Medium" severity rating.

A Bit More Detail

This vulnerability affects a wide range of GitLab installations—all versions starting from 10.5 up through 14.3.6, versions 14.4 through 14.4.4, and versions 14.5 through 14.5.2. The problem lies in the CI Lint API, a feature that helps developers validate their continuous integration configuration files. Attackers discovered they could abuse this API to make the GitLab server send requests to internal systems or external resources, potentially exposing sensitive information or accessing internal services that should be protected behind your firewall.

What makes this particularly concerning is that the attacker doesn't need any authentication—they can be completely external to your organization. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) tells us this is a network-based attack with high attack complexity, requiring no privileges and no user interaction, with changed scope and high confidentiality impact.

The Technical Specifics

  • Attack Vector: Network-based (AV:N) - attackers can exploit this remotely over the internet
  • Attack Complexity: High (AC:H) - requires specific conditions but is clearly achievable given active exploitation
  • Privileges Required: None (PR:N) - no authentication needed, making this especially dangerous
  • Affected Products: GitLab Community Edition (CE) and Enterprise Edition (EE)
    • All versions from 10.5 before 14.3.6
    • All versions from 14.4 before 14.4.4
    • All versions from 14.5 before 14.5.2
  • CWE Classification: CWE-918 (Server-Side Request Forgery)
  • Scope: Changed (S:C) - the vulnerability can affect resources beyond its original security scope
  • Impact: High confidentiality impact (C:H) - attackers can potentially access sensitive internal information
  • Original Disclosure: Reported via HackerOne (report #1236965) and tracked in GitLab issue #346187

Understanding Server-Side Request Forgery

Let me take a moment to explain what SSRF means in practical terms. Your GitLab server sits in a trusted position within your network—it can talk to internal services, databases, and resources that external users cannot reach directly. In a Server-Side Request Forgery attack, the attacker tricks your GitLab server into making requests on their behalf.

Here's a real-world analogy: imagine your company has a mail clerk who's authorized to access every department. An SSRF attack is like an outsider sending a letter to that mail clerk with instructions to go fetch confidential documents from the HR department and mail them back. The mail clerk has legitimate access, so security systems don't stop them—but they're being manipulated to abuse that access.

In this GitLab case, attackers can use the CI Lint API to make the server send requests to internal IP addresses (like 192.168.x.x or 10.x.x.x), cloud metadata services (like AWS's 169.254.169.254), or other internal services. This could expose environment variables, credentials, internal API endpoints, or other sensitive data that should never be accessible from outside your network.

Why CISA Added This to the KEV Catalog

The fact that CISA added this vulnerability to their Known Exploited Vulnerabilities catalog in February 2026—more than four years after the initial patches were released—tells us something important: attackers are finding and exploiting unpatched GitLab instances right now. CISA doesn't add vulnerabilities to the KEV catalog on speculation; they do it based on evidence of active exploitation in the wild.

For federal agencies, this triggers mandatory remediation requirements under Binding Operational Directive 22-01. But even if you're not a federal agency, you should treat KEV-listed vulnerabilities with the same urgency. These are the vulnerabilities that attackers are actively using to compromise organizations just like yours.

What You Should Do About This

  • Right Now - Immediate Actions:
    • Identify your GitLab version: Log into your GitLab instance and check Help → About or run gitlab-rake gitlab:env:info from the command line. If you're running any version from 10.5 through 14.5.1, you're vulnerable.
    • Check for exploitation attempts: Review your GitLab logs for unusual CI Lint API requests, particularly those attempting to access internal IP ranges or cloud metadata endpoints. Look for POST requests to /api/v4/ci/lint or /api/v4/projects/:id/ci/lint from unexpected sources.
    • Implement temporary mitigations: If you cannot patch immediately, consider restricting network access to the CI Lint API endpoints at your web application firewall or reverse proxy level, allowing only authenticated and authorized users.
  • For the Long Term - Permanent Remediation:
    • Upgrade GitLab immediately: Update to version 14.3.6, 14.4.4, 14.5.2, or any later version. GitLab released these patches in late 2021, and they've been available for years. Follow GitLab's official upgrade documentation carefully, as major version upgrades may require intermediate steps.
    • Review your network segmentation: Even with patches applied, ensure your GitLab server cannot access sensitive internal resources it doesn't need. Implement network segmentation and firewall rules to limit what your GitLab instance can reach.
    • Monitor for SSRF patterns: Implement monitoring for SSRF attack patterns, including requests to RFC 1918 private IP ranges, localhost addresses, cloud metadata endpoints (169.254.169.254), and link-local addresses.
    • Enable GitLab's built-in protections: Ensure that GitLab's SSRF protections are enabled and properly configured. Modern versions include settings to block requests to private networks and localhost.
    • Regular security audits: Make it a practice to review CISA's KEV catalog monthly and cross-reference it against your asset inventory. Vulnerabilities can be added years after initial disclosure when exploitation patterns change.

Detection and Hunting Guidance

If you're a security analyst or incident responder, here's what you should be looking for in your environment:

Log Analysis: Search your GitLab logs (typically in /var/log/gitlab/) for CI Lint API access patterns. Look for:


# Search for CI Lint API requests in GitLab logs
grep "ci/lint" /var/log/gitlab/gitlab-rails/production.log

# Look for requests with suspicious content or targeting internal IPs
grep -E "(127\.0\.0\.1|localhost|192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.169\.254)" /var/log/gitlab/gitlab-rails/production.log

Network Monitoring: Monitor outbound connections from your GitLab server for unusual patterns, particularly connections to internal IP ranges or cloud metadata services that shouldn't be accessed during normal operations.

SIEM Queries: If you're forwarding GitLab logs to a SIEM, create alerts for:

  • Unauthenticated requests to CI Lint API endpoints
  • CI Lint requests containing URL-encoded internal IP addresses
  • Unusual spikes in CI Lint API usage
  • CI Lint requests followed by outbound connections to internal services

Going Deeper: MITRE ATT&CK Context

For those of you who map threats to the MITRE ATT&CK framework, this vulnerability enables several techniques:

  • T1190 - Exploit Public-Facing Application: The initial exploitation vector, targeting the publicly accessible CI Lint API
  • T1557 - Adversary-in-the-Middle: SSRF can be used to intercept or manipulate internal communications
  • T1552.005 - Unsecured Credentials: Cloud Instance Metadata API: Attackers often use SSRF to access cloud metadata endpoints containing credentials
  • T1018 - Remote System Discovery: SSRF can be used to map internal network topology and discover internal services
  • T1071 - Application Layer Protocol: The attack uses legitimate HTTP/HTTPS protocols, making it harder to detect

Understanding these mappings helps you build better detection rules and understand how this vulnerability might fit into a broader attack chain. An attacker exploiting this SSRF vulnerability is likely not stopping there—they're using it as a stepping stone to gather information for further attacks.

A Word of Encouragement

I know it can feel overwhelming when vulnerabilities from years ago suddenly appear on active exploitation lists. You might be thinking, "We patched this back in 2021, didn't we?" or "How are we supposed to keep track of everything?" These feelings are completely valid, and you're not alone in experiencing them.

The reality is that security is a continuous journey, not a destination. The fact that you're reading this and taking action puts you ahead of many organizations. Take this as an opportunity to review your patch management processes, your vulnerability tracking procedures, and your monitoring capabilities. Each incident like this makes us stronger and more resilient.

Remember: the attackers are counting on organizations to forget about older vulnerabilities. By staying vigilant and maintaining good security hygiene, you're protecting not just your organization, but also your users, your customers, and your reputation.

Where I Found This Information

Note: This analysis is based on official sources including CISA's Known Exploited Vulnerabilities catalog and the National Vulnerability Database. The active exploitation status was confirmed by CISA on February 3, 2026. Always verify patch compatibility with your specific GitLab configuration and test updates in a non-production environment before deploying to production systems. If you need assistance with remediation, consider engaging with GitLab support or qualified security professionals.

Read more