CVE-2021-39935

VendorgitlabProductgitlabDiscoveredDec 13, 2021UpdatedFeb 4, 2026

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API

View graph Watch Export

CVSS v3.1

6.8 MEDIUM

EPSS

36.1%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Oct 7, 2026

▲ 0.49pp

35.6% → 36.1% over 2 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityHIGH

Privileges RequiredNONE

User InteractionNONE

ScopeCHANGED

ConfidentialityHIGH

IntegrityNONE

AvailabilityNONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Connections

4 relationships

CWE-918

source

Timeline

disclosure → media coverage

Dec 13, 2021

Disclosure — published as a CVE record. · last revised by NVD Feb 4, 2026

Oct 30, 2026

bleepingcomputer.com reports: CISA says max severity GitLab flaw now exploited in the wild