CVE-2021-39935: GitLab CI Lint API SSRF Allows Unauthenticated Internal Network Access

Affected Product: GitLab Community Edition (CE) and Enterprise Edition (EE), multiple versions prior to patched releases 12.0.12, 13.1.11, and 13.2.10.

Vulnerability Overview

CVE-2021-39935 is a Server-Side Request Forgery (SSRF) vulnerability in GitLab's CI Lint API endpoint. The flaw exists in both the Community and Enterprise Editions of GitLab and requires no authentication to exploit. An external attacker with network access to a vulnerable GitLab instance can send crafted requests to the /api/v4/projects/:id/ci/lint endpoint, forcing the GitLab server to make arbitrary HTTP requests to internal or external destinations on the attacker's behalf.

SSRF vulnerabilities of this class carry a CVSS v3 base score in the high-to-critical range depending on network exposure and available internal services. The unauthenticated nature of this attack vector makes it particularly dangerous for publicly accessible GitLab deployments.

Technical Details

The CI Lint API endpoint accepts pipeline configuration input and processes it server-side. GitLab failed to adequately validate or restrict URLs supplied within that configuration context, allowing the server to initiate outbound HTTP connections to attacker-controlled or internal targets.

Attack vector: Network (unauthenticated, remote) Privileges required: None User interaction: None

An attacker does not need a GitLab account. They only need HTTP access to the exposed API endpoint. By supplying crafted payloads, they can direct the GitLab server to reach:

  • Internal RFC-1918 address ranges and private network services
  • Cloud provider instance metadata services, including AWS IMDSv1 (http://169.254.169.254/latest/meta-data/iam/security-credentials/) and GCP metadata endpoints
  • Backend databases, CI runners, container registries, or other adjacent infrastructure
  • External attacker-controlled hosts for out-of-band data exfiltration confirmation

Cloud-hosted GitLab instances face elevated risk. AWS IMDSv1 endpoints, which do not require authentication by default, can return IAM role credentials directly. A single successful SSRF request against an unpatched instance with IMDSv1 enabled could yield temporary AWS access keys, enabling lateral movement into cloud infrastructure entirely outside the GitLab application layer.

Real-World Impact

Organizations running GitLab CE or EE in public-facing configurations — common in open-source projects, software development firms, and government agencies — expose internal infrastructure to reconnaissance and credential theft without requiring any attacker foothold inside the environment.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2021-39935 to its Known Exploited Vulnerabilities (KEV) catalog and mandated that federal civilian executive branch agencies apply patches by February 24, 2026, indicating confirmed exploitation activity warrants priority remediation treatment.

Beyond credential theft, attackers can use SSRF to map internal network topology, identify services running on non-public ports, trigger actions on internal HTTP APIs (such as administrative panels without external exposure), and exfiltrate configuration data. In CI/CD environments, where GitLab runners often have elevated permissions to deployment targets, the blast radius extends well beyond the GitLab server itself.

Affected Versions

GitLab has published patched releases across multiple stable branches:

  • 12.x branch: Upgrade to 12.0.12 or later
  • 13.1.x branch: Upgrade to 13.1.11 or later
  • 13.2.x branch: Upgrade to 13.2.10 or later

Instances running versions older than these thresholds on any supported branch remain vulnerable. Organizations running end-of-life GitLab versions should treat the exposure as critical and prioritize migration to a supported, patched release.

Patching and Mitigation Guidance

Primary remediation: Apply the vendor-supplied patch by upgrading GitLab to a fixed version per your active branch (12.0.12, 13.1.11, 13.2.10, or the current latest stable release).

Interim network controls: If immediate patching is not possible, restrict access to the CI Lint API endpoint at the network perimeter:

  • Configure firewall rules or a Web Application Firewall (WAF) to block unauthenticated external requests to /api/v4/projects/:id/ci/lint
  • Limit GitLab server outbound HTTP access to explicitly required destinations using egress filtering
  • If running on AWS, enforce IMDSv2 (token-required) on all EC2 instances hosting or adjacent to GitLab to eliminate metadata credential theft via SSRF

Detection: Audit GitLab access logs for unauthenticated POST requests to the CI Lint API endpoint. Flag requests originating from external IPs with no associated session token. Monitor outbound connections from the GitLab server to internal RFC-1918 ranges and cloud metadata IP addresses (169.254.169.254, metadata.google.internal).

SOC teams should create detection rules in their SIEM for unauthenticated API calls to this endpoint, particularly at volume or from previously unseen source IPs. Correlate GitLab access logs with outbound firewall logs to identify successful SSRF-initiated connections.

CISA KEV deadline for federal agencies: February 24, 2026. Private sector organizations should treat this deadline as a benchmark and prioritize patching within the same window given confirmed exploitation.