A Five-Year-Old GitLab Flaw Resurfaces: CVE-2021-39935 and the Ongoing Challenge of Patch Management

A Five-Year-Old GitLab Flaw Resurfaces: CVE-2021-39935 and the Ongoing Challenge of Patch Management

Alex Cipher's Profile Pictire Alex Cipher 8 min read

A five-year-old flaw in GitLab, tracked as CVE-2021-39935, has resurfaced as a major cybersecurity headache, with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issuing a fresh warning after active exploitation was detected in the wild (BleepingComputer). This vulnerability, lurking in the CI Lint API, allows attackers to manipulate GitLab servers into making unauthorized requests—essentially turning the platform into a launchpad for deeper network intrusions. Despite a patch being available since late 2021, over 49,000 internet-exposed GitLab instances remain at risk as of February 2026, with nearly 27,000 running on the default HTTPS port (Shodan via BleepingComputer).

What makes this flaw especially dangerous is its accessibility: no authentication is required, and public exploit code is readily available (National Vulnerability Database). Attackers have used it for everything from internal reconnaissance to accessing sensitive cloud metadata, often chaining it with other vulnerabilities for maximum impact (CyberPress). The persistent exploitation of this bug highlights the ongoing challenges organizations face in patch management, asset discovery, and keeping pace with evolving threats (GitLab Advisory).

How the GitLab CVE-2021-39935 Vulnerability Became a Hacker’s Playground

Anatomy of the Vulnerability: SSRF in the CI Lint API

The GitLab vulnerability tracked as CVE-2021-39935 is rooted in a server-side request forgery (SSRF) flaw within the CI Lint API. This API is designed to validate and simulate continuous integration/continuous deployment (CI/CD) configurations. The flaw affects both Community and Enterprise Editions of GitLab, specifically all versions from 10.5 before 14.3.6, 14.4 before 14.4.4, and 14.5 before 14.5.2 (BleepingComputer).

The vulnerability arises due to insufficient validation of user-supplied URLs during CI configuration checks. This oversight enables unauthenticated attackers to craft malicious requests to the CI Lint API, forcing the GitLab server to initiate arbitrary HTTP requests to internal or external endpoints. Such SSRF vulnerabilities are particularly dangerous because they can be leveraged to:

  • Bypass network segmentation and access internal resources not intended to be publicly reachable.
  • Enumerate and interact with internal services, databases, or metadata endpoints.
  • Chain with other vulnerabilities to escalate privileges or exfiltrate sensitive data.

The risk is exacerbated by the fact that, in misconfigured environments or when user registration is restricted, external users who are not developers should not have access to the CI Lint API. However, due to the flaw, this restriction is bypassed, allowing virtually anyone to exploit the vulnerability (GitLab Advisory).

Widespread Exposure and Attack Surface

The scale of the attack surface for CVE-2021-39935 is significant. As of February 2026, Shodan identified over 49,000 internet-exposed devices with a GitLab fingerprint, with nearly 27,000 operating on the default HTTPS port (443). Notably, the majority of these exposed instances are located in China, but the global distribution means organizations across all sectors and geographies are at risk.

GitLab’s popularity amplifies the threat. The platform boasts over 30 million registered users and is in use by more than half of the Fortune 100, including high-profile enterprises such as Nvidia, Airbus, Goldman Sachs, T-Mobile, and Lockheed Martin (BleepingComputer). This widespread adoption ensures that any vulnerability in GitLab, especially one that is easily exploitable and does not require authentication, becomes an attractive target for attackers.

The presence of unpatched systems years after the initial disclosure (the flaw was patched in December 2021) demonstrates the persistent challenge of timely vulnerability management, particularly in complex, distributed IT environments.

Exploitation Techniques and Real-World Attacks

Attackers have leveraged CVE-2021-39935 in a variety of ways, taking advantage of the SSRF flaw’s flexibility. The most common exploitation scenarios observed include:

  • Internal Reconnaissance: By exploiting the SSRF, attackers can probe internal network resources, discovering services and endpoints that are not exposed to the public internet. This can lead to further attacks against internal assets.
  • Accessing Cloud Metadata Services: Many cloud providers expose metadata endpoints (such as AWS’s 169.254.169.254) that, if accessed, can reveal sensitive information like temporary credentials. SSRF vulnerabilities are a well-known vector for accessing such endpoints, and attackers have used CVE-2021-39935 to attempt this (CyberPress).
  • Chaining with Other Vulnerabilities: SSRF can serve as a foothold for more complex attack chains. For example, attackers may use SSRF to bypass firewalls or gain access to internal APIs, which can then be exploited via other vulnerabilities for privilege escalation or lateral movement.

The existence of public exploit code and automated tools has further lowered the barrier to exploitation. The National Vulnerability Database and security vendors have confirmed that proof-of-concept exploits are available, making it trivial for even low-skilled attackers to target vulnerable GitLab instances.

Delayed Patching and Organizational Challenges

Despite a patch being released in December 2021, the vulnerability remained unaddressed in thousands of deployments for years. Several factors contributed to this prolonged window of exposure:

  • Complex Upgrade Cycles: Many organizations run self-hosted GitLab instances that are deeply integrated into their development workflows. Upgrading such systems can be disruptive, leading to delays in applying security patches.
  • Lack of Awareness: Some administrators may have been unaware of the criticality of CVE-2021-39935, especially if they did not closely monitor security advisories or lacked automated vulnerability management tools.
  • Shadow IT and Forgotten Instances: Large enterprises often have multiple, sometimes undocumented, GitLab installations. These “shadow IT” instances may not be included in regular patch management processes, remaining vulnerable long after official patches are released.

CISA’s decision to add CVE-2021-39935 to its Known Exploited Vulnerabilities (KEV) Catalog in February 2026 underscores the persistence of the threat. Federal agencies were given a three-week deadline (until February 24, 2026) to patch or mitigate the vulnerability, but the directive also urged private sector organizations to take immediate action (Cyber Web Spider).

The Appeal to Threat Actors: Low Barrier, High Impact

CVE-2021-39935’s attractiveness to malicious actors is rooted in several factors:

  • No Authentication Required: The flaw can be exploited by unauthenticated users, meaning attackers do not need valid credentials or privileged access to launch attacks.
  • High Probability of Success: With a CVSS score of 7.5 (High) and an Exploitation Probability Percentile (EPSS) of 96.4%, the vulnerability is both easy to exploit and likely to succeed, especially against unpatched targets.
  • Potential for Stealthy Attacks: SSRF attacks can be difficult to detect, as the malicious requests originate from the trusted GitLab server itself. This can allow attackers to operate undetected for extended periods.
  • Wide Range of Potential Targets: The diversity of organizations using GitLab, from small startups to critical infrastructure providers, ensures that attackers have a broad pool of potential victims.

The combination of these factors has made CVE-2021-39935 a staple in the toolkits of both opportunistic cybercriminals and more sophisticated threat actors. The addition of the vulnerability to CISA’s KEV catalog signals that it is being actively exploited in the wild, with real-world incidents reported across multiple sectors (GBHackers).

Mitigation Gaps and Ongoing Risks

While patches have been available for over four years, the ongoing exploitation of CVE-2021-39935 highlights systemic issues in vulnerability management:

  • Incomplete or Ineffective Mitigations: Some organizations may have attempted to mitigate the risk by restricting access to the CI Lint API or implementing network segmentation. However, without fully applying the vendor’s patch, these measures can be bypassed by determined attackers.
  • Cloud and Hybrid Environments: As organizations migrate to cloud or hybrid infrastructures, legacy GitLab instances may be overlooked, especially if they are not integrated with centralized security monitoring solutions.
  • Vendor Guidance and Compliance: CISA’s directive emphasizes the need to follow vendor instructions and, where mitigations are unavailable, to discontinue use of the affected product. However, compliance remains inconsistent, particularly outside regulated sectors.

The persistent exploitation of this vulnerability serves as a case study in the importance of proactive patch management, continuous asset discovery, and the need for organizations to maintain visibility over all internet-facing assets (Rankiteo Blog).

Note: This report is based on the latest available information as of February 4, 2026. All referenced data and URLs are current as of this date.

Final Thoughts

The saga of CVE-2021-39935 is a stark reminder that even well-known vulnerabilities can remain potent threats years after disclosure if patching and asset management fall short. The continued exploitation of this GitLab flaw—despite clear vendor guidance and CISA’s inclusion in the Known Exploited Vulnerabilities Catalog—underscores the need for organizations to prioritize proactive security hygiene. Automated vulnerability scanning, continuous asset discovery, and robust patch management are not just best practices; they are essential defenses in a landscape where attackers are quick to weaponize even the oldest of bugs (Rankiteo Blog).

As emerging technologies like AI and IoT expand the attack surface, the lessons from this GitLab incident are more relevant than ever. Staying ahead of threats means not just reacting to headlines, but building resilient, adaptable security programs that leave no system behind (GBHackers).

References

Related Articles