← CVE Radar
CVE-2021-39935GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
7.5 HIGHEPSS 36.14%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.5 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 6.8 | MEDIUM | 3.1GitLab (CNA) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N |
| 5.0 | MEDIUM | 2.0NVD | AV:N/AC:L/Au:N/C:P/I:N/A:N |
CISA required action
⚡ Known exploited · remediation due Feb 24, 2026
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2021-39935
- Status
- Analyzed
- Assigner (CNA)
- GitLab
- Published
- Dec 13, 2021
- Last modified
- 2026-06-17 04:04 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
GitLabGitLab3 version ranges
- >=10.5, <14.3.6
- >=14.4, <14.4.4
- >=14.5, <14.5.2