The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a new warning about an actively exploited Server-Side Request Forgery (SSRF) vulnerability in GitLab Community and Enterprise Editions.
The flaw, tracked as CVE‑2021‑39935, allows remote attackers to perform unauthorized server-side requests via the CI Lint API, potentially exposing sensitive internal systems or triggering further exploitation paths.
CISA added this vulnerability to its Known Exploited Vulnerabilities Catalog on February 3, 2026, advising all federal agencies and organizations using vulnerable GitLab versions to apply the available mitigations before February 24, 2026, per the Binding Operational Directive (BOD) 22‑01.
Vulnerability Details and Impact
The flaw exists due to improper validation of user-supplied URLs during continuous integration configuration checks.
An attacker without authentication could exploit this issue by crafting a malicious API request to force GitLab servers to connect to arbitrary internal or external resources.
This could lead to internal network scanning, data exposure, credential leakage, or even exploitation of secondary vulnerabilities within connected services.
| CVE ID | Description | CWE ID | Exploitation Status | Action | Date Added | Due Date |
|---|---|---|---|---|---|---|
| CVE‑2021‑39935 | Server‑Side Request Forgery (SSRF) in GitLab Community and Enterprise Editions via CI Lint API | CWE‑918 | Confirmed exploitation in the wild | Apply vendor mitigations per CISA BOD 22‑01 | 2026‑02‑03 | 2026‑02‑24 |
CISA emphasizes that timely patch management of developer and CI/CD platforms is essential to prevent exploitation chains that could lead to broader supply‑chain events.
Although GitLab patched this vulnerability shortly after its discovery in 2021, recent reports suggest renewed interest and exploitation by threat actors targeting unpatched GitLab servers exposed to the internet.
Unauthenticated SSRF exploitation is particularly dangerous in development and CI/CD pipeline environments because it may allow access to sensitive metadata services in cloud-hosted deployments, revealing tokens or configuration secrets.
CISA has not directly attributed the recent activity to a specific threat actor or ransomware group, but analysts note that SSRF vulnerabilities have historically been leveraged by advanced attackers to pivot into internal environments.
In some cases, similar flaws were used to deploy crypto‑miners or as initial intrusion vectors in supply chain compromises.
GitLab has released security updates for both Community and Enterprise Editions addressing CVE‑2021‑39935.
Organizations are urged to:
- Upgrade immediately to the latest fixed version as listed in GitLab’s official security advisory.
- Review and restrict API exposure, especially instances accessible from public networks.
- Monitor CI/CD logs for abnormal requests or failed connection attempts originating from atypical IPs.
- Implement network segmentation to protect internal services from direct access or proxy‑based scans.
- Follow CISA’s BOD 22‑01 guidance for patch verification and continued vulnerability monitoring.
Given GitLab’s extensive use in source code management and DevOps workflows, unpatched instances present an attractive target for adversaries seeking lateral movement opportunities.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=The flaw, tracked as CVE‑2021‑39935, allows remote attackers to perform unauthorized server-side requests via the CI Lint API){kind=link}