GitLab CE/EE CI Lint API Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-39935) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTGitLab CE/EE versions 10.5 before 14.3.6, 14.4 before 14.4.4, and 14.5 before 14.5.2
Unauthorized external attackers can perform Server-Side Request Forgery (SSRF) via the CI Lint API to access internal network resources and extract sensitive data
Immediately upgrade GitLab instances to patched versions (14.3.6, 14.4.4, 14.5.2 or later) and restrict external access to the CI Lint API
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patches immediately by upgrading your GitLab instance to a secure version. Use the following commands to perform the upgrade:
# Check current GitLab version
gitlab-rake gitlab:env:info
# Upgrade GitLab CE/EE on Ubuntu/Debian
sudo apt-get update
sudo apt-get install --only-upgrade gitlab-ce=14.5.2-ce.0
# Or for EE version
sudo apt-get install --only-upgrade gitlab-ee=14.5.2-ee.0
# Reconfigure and restart GitLab services
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, restrict access to the CI Lint API endpoint using a reverse proxy (e.g., Nginx) or a Web Application Firewall (WAF).
# Nginx configuration block (/etc/gitlab/nginx.conf or reverse proxy config)
# Restrict access to the CI Lint API to trusted internal networks only
location ~* ^/api/v4/ci/lint {
allow 192.168.1.0/24; # Replace with your trusted IP range
deny all;
proxy_pass http://gitlab-workhorse;
}3. Log Audit & IoC Verification Commands
Inspect GitLab API logs to identify potential exploitation attempts targeting the CI Lint API endpoint (/api/v4/ci/lint).
# Search GitLab API logs for requests to the CI Lint endpoint
# Filter for successful or suspicious requests from external IPs
grep -E '/api/v[0-9]+/ci/lint' /var/log/gitlab/gitlab-rails/api_json.log | jq 'select(.status == 200) | {time, remote_ip, params}'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-39935) is a Server-Side Request Forgery (SSRF, CWE-918) vulnerability in the CI Lint API component of GitLab Community Edition (CE) and Enterprise Edition (EE). The root cause lies in the insufficient validation of user-supplied inputs within the CI Lint API, which is designed to validate the syntax of .gitlab-ci.yml files. The application fails to properly restrict requests targeting internal network addresses or loopback interfaces.
2. Exploitation Mechanics & Attack Scenario
An unauthorized external attacker can send crafted payloads to the CI Lint API endpoint. By embedding URLs pointing to internal infrastructure services (such as cloud metadata services like AWS IMDS http://169.254.169.254/ or internal database endpoints) inside the configuration file to be validated, the attacker forces the GitLab server to initiate HTTP requests to these private resources. The server then processes or returns the response, effectively bypassing perimeter firewalls.
3. Infrastructure & Business Impact
This vulnerability is listed on the CISA KEV (Known Exploited Vulnerabilities) catalog, indicating active exploitation in the wild. Successful exploitation allows attackers to scan internal networks, access restricted internal APIs, and potentially retrieve highly sensitive cloud credentials (e.g., IAM role tokens), leading to severe data breaches and potential lateral movement within the enterprise network.
Official Vendor Advisories & References
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
Frequently Asked SecOps Questions (CVE-2021-39935)
FAQQ1. How critical is CVE-2021-39935 and is it actively exploited in the wild?
CVE-2021-39935 is rated CVSS 6.8 (MEDIUM) with a 30-day EPSS exploitation probability of 36.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-39935?
Primary impacted vendors include gitlab across gitlab_ce, gitlab_ee. Scope summary: GitLab CE/EE versions 10.5 before 14.3.6, 14.4 before 14.4.4, and 14.5 before 14.5.2
Q3. What temporary mitigations or workarounds exist for CVE-2021-39935 before patching?
[Mitigation] Immediately upgrade GitLab instances to patched versions (14.3.6, 14.4.4, 14.5.2 or later) and restrict external access to the CI Lint API Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-39935
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (gitlab)
View Category →GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Plex Media Server SSRF Vulnerability Advisory (CVE-2026-96655)
[Affected Scope] All Plex Media Server installations prior to version 1.43.3.10861
Plex Media Server SSRF Vulnerability Advisory (CVE-2026-96652) - Internal Network Pivoting and Request Forgery
[Affected Scope] All Plex Media Server installations prior to version 1.43.3.10861.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.