CVE-2021-39935
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
Description
CVE-2021-39935 is a medium-severity Server-Side Request Forgery (SSRF) vulnerability in GitLab Community Edition and Enterprise Edition that allows unauthorized external users to perform server-side requests through the CI Lint API. With a CVSS v3.1 base score of 6.8, the flaw affects all versions from 10.5 before 14.3.6, from 14.4 before 14.4.4, and from 14.5 before 14.5.2. Despite its medium severity rating, CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 24, 2026, indicating confirmed active exploitation. The EPSS score of 54.31% at the 98.0th percentile is exceptionally high for a medium-severity vulnerability, placing it among the top 2% of all tracked vulnerabilities by exploitation probability and reflecting sustained, widespread exploitation activity against GitLab instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | >= 10.5.0, < 14.3.6; >= 14.4.0, < 14.4.4; >= 14.5.0, < 14.5.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39935.json(Third Party Advisory)
- https://gitlab.com/gitlab-org/gitlab/-/issues/346187(Issue Tracking, Vendor Advisory)
- https://hackerone.com/reports/1236965(Permissions Required, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39935(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
CVE-2021-39935 is classified under CWE-918 (Server-Side Request Forgery). SSRF occurs when a web application fetches a remote resource based on a user-supplied URL without properly validating the destination. In GitLab's CI Lint API, the application processes CI configuration input that can reference external resources. An attacker can manipulate this input to cause the GitLab server to make HTTP requests to arbitrary internal or external destinations. This allows the attacker to scan internal network services, access cloud metadata endpoints (such as AWS IMDSv1 at 169.254.169.254), read internal application data, and potentially interact with internal services that are not exposed to the external network. SSRF vulnerabilities are particularly dangerous in cloud-hosted environments where metadata services can expose credentials, tokens, and configuration data that enable further compromise. Learn more about CWE-918
Impact Analysis
The impact of CVE-2021-39935 is significant despite its medium CVSS score, as evidenced by the extraordinary EPSS score of 54.31% at the 98th percentile. Confidentiality is the primary impact dimension, rated High with a Changed scope in the CVSS vector. The SSRF vulnerability allows an attacker to read data from internal services that are normally inaccessible from the external network. In cloud environments, this commonly includes cloud provider metadata services that expose instance credentials, API tokens, and infrastructure configuration. For GitLab instances running on AWS, GCP, or Azure, the attacker can retrieve temporary security credentials that grant access to cloud resources, storage buckets, databases, and other services configured for the instance role. Even in on-premises deployments, the SSRF enables reconnaissance of internal network services, port scanning, and data extraction from internal HTTP-accessible resources.
The Changed Scope (S:C) in the CVSS vector is critical because it indicates the vulnerability's impact extends beyond the GitLab application itself. The GitLab server becomes a proxy that the attacker uses to reach internal infrastructure, effectively bypassing network segmentation and firewall rules. While the CVSS vector rates Integrity and Availability as None, the practical impact of credential theft through cloud metadata access can lead to full infrastructure compromise. The 54.31% EPSS score at the 98th percentile reflects the reality that SSRF vulnerabilities in widely-deployed applications are among the most frequently exploited classes, particularly because automated scanning tools can rapidly identify and exploit them at scale. The ransomware association is classified as unknown.
Exploit Maturity
CVE-2021-39935 demonstrates extraordinary exploit maturity for a medium-severity vulnerability. The EPSS score of 54.31% at the 98.0th percentile means that more than half of exposed GitLab instances can expect exploitation attempts, placing this among the most actively targeted vulnerabilities in the entire tracked ecosystem. CISA's KEV listing with a remediation deadline of February 24, 2026 confirms ongoing real-world exploitation. The vulnerability was originally disclosed in December 2021 and was reported through HackerOne, with the official GitLab issue tracking at GitLab issue 346187 and the CVE details at GitLab CVE database.
SSRF vulnerabilities in the CI Lint API are particularly easy to exploit because the API is designed to process CI configuration content, which naturally includes references to external resources. The attacker simply submits crafted CI configuration through the lint endpoint that causes the GitLab server to make requests to attacker-specified URLs, including internal network addresses and cloud metadata endpoints. No authentication is required to access the CI Lint API in affected versions, and the exploitation requires only basic HTTP requests that can be fully automated. The five-year gap between the vulnerability's initial disclosure and its current CISA KEV addition reflects the persistent problem of unpatched GitLab instances remaining exposed on the internet, which attackers continue to discover and exploit through automated scanning.
Remediation
-
Upgrade GitLab to a patched version immediately. For the 14.3.x branch, upgrade to 14.3.6 or later. For the 14.4.x branch, upgrade to 14.4.4 or later. For the 14.5.x branch, upgrade to 14.5.2 or later. If running any version between 10.5 and 14.3.5, upgrade to 14.3.6 at minimum. Given the five-year age of this vulnerability and the current EPSS score of 54.31%, any GitLab instance still running affected versions is almost certainly being targeted.
-
Restrict access to the CI Lint API as an immediate compensating control if upgrading requires scheduling downtime. Use GitLab's built-in IP restriction features or a reverse proxy to limit access to the CI Lint endpoint to trusted networks and authenticated users only. Block external access to the endpoint entirely if CI linting from external sources is not a business requirement.
-
Implement cloud metadata service protections for GitLab instances running in cloud environments. On AWS, enforce IMDSv2 (token-based) to prevent SSRF-based metadata access. On GCP and Azure, configure equivalent metadata endpoint protections. These controls mitigate the most damaging exploitation path even if the SSRF is exploited before patching.
-
Audit cloud credentials and internal service access for any GitLab instance that was running a vulnerable version while exposed to untrusted networks. Review cloud provider audit logs for unexpected API calls using the instance's credentials, check for unauthorized resource access, and rotate any credentials that may have been exposed through the metadata service.
-
Implement network-level SSRF protections by configuring the GitLab server's outbound network access to deny connections to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.0.0/16) from the application layer. This defense-in-depth measure limits the impact of any SSRF vulnerability, not just this specific CVE.
Technical Details
CVE-2021-39935 is a Server-Side Request Forgery vulnerability in GitLab CE/EE, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N. Breaking down the vector: Attack Vector (AV:N) confirms remote network exploitation. Attack Complexity (AC:H) indicates that some conditions beyond the attacker's control must be met, such as specific network configurations or cloud metadata service availability. Privileges Required (PR:N) means no authentication is needed to access the vulnerable CI Lint API endpoint. User Interaction (UI:N) confirms fully automated exploitation. Scope (S:C) is the key differentiator, indicating that the vulnerability's impact crosses security boundaries, allowing the attacker to reach internal services beyond the GitLab application. Confidentiality (C:H) reflects the high-value data accessible through SSRF, while Integrity (I:N) and Availability (A:N) are rated None because the SSRF primarily enables data reading rather than modification or disruption.
The vulnerability exists in GitLab's CI Lint API, which validates and processes CI/CD configuration files. The CI configuration format supports includes and references to external resources, and the Lint API processes these references server-side. The vulnerable code path accepts user-supplied URLs within CI configuration content and causes the GitLab server to make HTTP requests to those URLs without adequate validation of the destination address. An attacker crafts a CI configuration that includes references to internal network addresses or cloud metadata endpoints and submits it to the Lint API. The GitLab server processes the configuration, makes the specified requests, and returns the results to the attacker, effectively acting as an open proxy to the internal network.
The vulnerability affects all GitLab versions from 10.5.0, spanning a very large version range. The patches in versions 14.3.6, 14.4.4, and 14.5.2 implement URL validation that blocks requests to private IP ranges and restricts the destinations that the CI Lint API can reach during configuration processing.
Frequently Asked Questions
What is CVE-2021-39935?
CVE-2021-39935 is a Server-Side Request Forgery (SSRF) vulnerability in GitLab CE/EE that allows unauthenticated attackers to make the GitLab server send HTTP requests to arbitrary internal and external targets through the CI Lint API. Despite its medium CVSS score of 6.8, it has an exceptionally high EPSS score of 54.31%.
Why does a medium-severity vulnerability have such a high exploitation rate?
The SSRF vulnerability is trivially exploitable without authentication, affects a very wide range of GitLab versions (10.5 through 14.5.1), and provides high-value results in cloud environments where metadata services expose credentials. The combination of easy exploitation and valuable returns makes it a priority target for automated scanning campaigns.
Which GitLab versions are affected?
All GitLab CE/EE versions from 10.5.0 before 14.3.6, from 14.4.0 before 14.4.4, and from 14.5.0 before 14.5.2 are affected. Organizations should upgrade to at least 14.3.6, 14.4.4, or 14.5.2 depending on their current branch.
What data can an attacker access through this vulnerability?
The SSRF allows the attacker to read responses from internal services accessible from the GitLab server. In cloud environments, this commonly includes cloud metadata endpoints that expose temporary credentials, API tokens, and infrastructure configuration. In on-premises environments, the attacker can scan internal networks and access HTTP services not intended to be externally reachable.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.