CVE-2021-39935

CVE-2021-39935 is a server-side request forgery (CWE-918) in GitLab Community Edition and Enterprise Edition that allows unauthorized external users to make the GitLab server issue requests through the CI Lint API. By abusing the server's network position, an attacker can reach internal-only resources such as loopback or private-network services, potentially mapping or accessing internal infrastructure without credentials. All deployments of the affected editions are potentially exposed, with actual risk depending on whether the CI Lint API is reachable by unauthenticated external users. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-03, indicating known exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed. EPSS estimates a 35.6% probability of exploitation within 30 days (98th percentile).

What to do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory for CVE-2021-39935 (version numbers are not provided in the source data). Until patching is complete, restrict unauthenticated external access to the CI Lint API (e.g., at the reverse proxy or firewall) and review logs for unexpected requests to loopback or internal-network targets originating from CI lint calls. Federal agencies must follow BOD 22-01 remediation timelines following the 2026-02-03 KEV listing; discontinue or isolate use if mitigations are unavailable.