CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
Published Dec 13, 2021 · Updated Jun 17, 2026
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More GitLab vulnerabilities
All GitLab entriesCVE-2026-103515
GitLab EE improper access control in group Duo admin-lock enforcement for Amazon Q settings
low2.7Oct 21, 2026CVE-2026-105711
GitLab CE/EE use of cache containing sensitive information in merge request title rendering
low3.5Oct 21, 2026CVE-2026-105777
GitLab CE/EE internal credential exposure in internal response headers
medium4.3Oct 21, 2026CVE-2026-110264
GitLab CE/EE integer overflow in regular expression compiler allows unauthenticated remote code execution
critical10.0Oct 21, 2026CVE-2026-112212
GitLab CE/EE cache poisoning in OAuth/OIDC discovery endpoints
high7.5Oct 21, 2026CVE-2026-112326
GitLab EE improper cleanup on thrown exception in security findings
low3.1Oct 21, 2026