GitLab
GitLab Community and Enterprise Editions Server-side Request Forgery (SSRF) Vulnerability
At a glance
Actively exploited in the wild — prioritise confirming exposure.
High rather than Critical: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on GitLab, treat it as Critical.
Briefing
- Do not treat uncorroborated claims as confirmed breaches.
Questions to ask IT
- Do we run GitLab, and is every instance on a fixed release (14.3.6, 14.4.4 or 14.5.2, or later)?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm exposure, mitigation status and any service interruption risk.
Vulnerability facts
Full CVE detail CVE-2021-39935- 6.8 · MediumExploitable over the network without any account, under specific conditions, and no one has to click or open anything. High impact on confidentiality, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- Listed: attacks using it have been seen (on the catalogue since )
- Elevated attack likelihood (~36.1% in 30 days)
- 10.5 before 14.3.6, 14.4 before 14.4.4, 14.5 before 14.5.2
- 14.3.6, 14.4.4, 14.5.2
Versions are as the CVE record states them; check the vendor advisory before planning a fix.
No technical write-up beyond these facts and the summary below yet.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorised external users to perform Server Side Requests via the
- CVE-2021-39935 is listed in known-exploited catalogue (exploitation in the wild)
- Authoritative catalogues report active exploitation of this vulnerability.
Why this matters in the UK
- Known-exploited catalogue reports exploitation in the wild
Products and services involved
- GitLab92% match confidence · CVE-2021-39935
Pulse
Last checked 4d ago · Recheck overdue since 5 Nov 2026, 22:05 UK time · 4 quiet checks collapsed
in the next 30 days first recorded at 35.6% (elevated likelihood signal, not confirmed exploitation).
Elevated — confirm exposure; this is a probability signal, not confirmed exploitation.
2 quiet checks hidden.
Sources
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ConfirmedHeadline90% confidence
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
- ConfirmedSummary fact75% confidence
GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorised external users to perform Server Side Requests via the CI Lint API. Affects GitLab Community and Enterprise Editions. Known ransomware campaign use: Unknown. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2021-39935
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2021-39935 is listed in known-exploited catalogue (exploitation in the wild)