The Cybersecurity and Infrastructure Security Agency (CISA) has added a server-side request forgery (SSRF) vulnerability affecting GitLab Community Edition and Enterprise Edition to its Known Exploited Vulnerabilities (KEV) Catalog. This designation is important—it means the flaw has been observed being actively exploited in real-world attacks, not just discussed in theory.

Vulnerability ID: CVE-2021-39935
Vulnerability type: Server-Side Request Forgery (SSRF)
Affected products: GitLab Community Edition and GitLab Enterprise Edition (self-managed instances)
Exploitation status: Actively exploited in the wild, according to CISA’s KEV listing

What the SSRF Vulnerability Allows

SSRF vulnerabilities make it possible for attackers to trick an application into sending HTTP requests on their behalf. In the case of this GitLab flaw:

• Attackers can abuse the GitLab CI Lint API to force the server to issue arbitrary outbound requests.
• This behavior can be used to probe internal systems, access cloud metadata services, or otherwise bypass network-level protections that normally restrict direct access.

Impact and Risk

Because GitLab is frequently exposed to the internet for development, integration, and CI/CD operations, the impact can be significant:

• Internal infrastructure may be scanned or accessed through the vulnerable endpoint.
• The flaw can serve as a foothold for lateral movement inside an organization’s network.
• In more advanced attack chains, SSRF could lead to sensitive data exposure or enable follow-on exploitation.

Remediation and Required Response

When CISA adds a vulnerability to the KEV Catalog, it signals urgency:

• Under Binding Operational Directive (BOD) 22-01, U.S. federal agencies are required to remediate the vulnerability by a mandated deadline, often within weeks of its inclusion.
• GitLab has released patches addressing the issue, and administrators are strongly urged to upgrade to patched versions immediately and review how the CI Lint API is being used in their environments.

Broader Context

This GitLab SSRF issue is part of a broader wave of vulnerabilities recently added to the KEV Catalog. The same update also includes a critical deserialization flaw in SolarWinds products and vulnerabilities affecting Sangoma Technologies FreePBX—all of which have either been confirmed as exploited or credibly reported as such.

Final Takeaway

CISA’s warning confirms that CVE-2021-39935 is being exploited in the wild. Organizations running affected self-managed GitLab instances should treat this as a high-priority security issue, apply patches without delay, and closely monitor for any signs of suspicious SSRF-related activity.