CISA Alerts Agencies to Patch Five-Year-Old GitLab Vulnerability CVE-2021-39935

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical vulnerability in GitLab, tracked as CVE-2021-39935, which has been actively exploited in cyberattacks. This server-side request forgery (SSRF) flaw affects all GitLab Community and Enterprise Editions from version 10.5 to 14.3.6, and from 14.4 to 14.4.4, as well as from 14.5 to 14.5.2. GitLab issued a patch for this vulnerability in December 2021, but the ongoing exploitation highlights the importance of timely updates and security measures.

CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies must patch their systems by February 24, 2026, as part of Binding Operational Directive (BOD) 22-01. Although this directive specifically targets federal agencies, CISA has strongly recommended that all organizations, including those in the private sector, prioritize the mitigation of this vulnerability. The agency warns that such vulnerabilities are common attack vectors for malicious actors and pose significant risks.

Currently, Shodan reports over 49,000 devices with a GitLab fingerprint exposed online, predominantly located in China, with nearly 27,000 using the default port 443. GitLab’s platform is widely used, with over 30 million registered users, including major companies like Nvidia, Airbus, Goldman Sachs, T-Mobile, and Lockheed Martin. This extensive use makes the vulnerability even more critical to address.

Why This Matters for Your Security

The exploitation of CVE-2021-39935 serves as a reminder of the risks associated with unpatched vulnerabilities. Organizations must remain vigilant about applying security updates promptly to protect their systems from unauthorized access. The fact that CISA is urging all organizations to take action indicates the potential for widespread impact if the vulnerability is not addressed.

Users and organizations should monitor their GitLab installations and ensure they are running the latest versions. Regular security audits and vulnerability assessments can help identify and mitigate risks before they can be exploited. Additionally, organizations should consider implementing stricter access controls to limit exposure to such vulnerabilities.

As cyber threats continue to evolve, staying informed about vulnerabilities and following best practices for security will be crucial in safeguarding sensitive information and maintaining operational integrity.

• CVE-2021-39935 – A server-side request forgery vulnerability in GitLab that allows unauthorized access to the CI Lint API.
• CISA – The U.S. Cybersecurity and Infrastructure Security Agency, which has mandated federal agencies to patch this vulnerability.
• GitLab – A DevSecOps platform with over 30 million registered users, including many Fortune 100 companies.
• Shodan – A search engine that tracks devices exposed online, currently reporting over 49,000 GitLab installations.