Loading story…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a GitLab server-side request forgery vulnerability, CVE-2021-39935, to its Known Exploited Vulnerabilities (KEV) catalog after observing active exploitation in the wild. The flaw affects GitLab Community Edition and Enterprise Edition and was originally fixed by GitLab in December 2021; it allows unauthorized external users to abuse the CI Lint API (used to validate CI/CD configurations) to trigger server-side requests.
CISA ordered Federal Civilian Executive Branch (FCEB) agencies to remediate under Binding Operational Directive 22-01, setting a patch deadline of February 24, 2026, and urged private-sector organizations to prioritize mitigation or discontinue use if mitigations are unavailable. Reporting highlighted that the SSRF condition can be leveraged to reach otherwise inaccessible internal resources (e.g., internal services/APIs or cloud metadata endpoints) and noted broad internet exposure of GitLab instances (with Shodan tracking tens of thousands of GitLab-fingerprinted systems), increasing the potential attack surface even though specific public campaigns were not detailed.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Under Binding Operational Directive 22-01, CISA directed U.S. federal civilian agencies to patch or mitigate CVE-2021-39935 and set a remediation deadline of 2026-02-24. CISA also urged organizations to apply workarounds such as disabling the CI Lint API and reviewing logs for suspicious activity if immediate patching was not possible.
CISA added the GitLab SSRF vulnerability CVE-2021-39935 to its Known Exploited Vulnerabilities catalog after determining it was being actively exploited in the wild. The agency warned the flaw could be used for internal network scanning, access to cloud metadata services, or interaction with internal APIs.
GitLab patched CVE-2021-39935 in December 2021, addressing a server-side request forgery issue in the CI Lint API affecting Community and Enterprise Edition versions from 10.5 up to 14.3.6, 14.4.4, and 14.5.2 depending on branch. GitLab warned that unauthorized external users could abuse the flaw to make server-side requests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **two actively exploited vulnerabilities** to its Known Exploited Vulnerabilities (KEV) Catalog: **CVE-2021-22175** (a **GitLab** server-side request forgery (SSRF) issue related to enabling internal-network requests for webhooks) and **CVE-2026-22769** (a **Dell RecoverPoint for Virtual Machines (RP4VMs)** vulnerability involving **hard-coded credentials** that can enable unauthenticated access to the underlying OS and **root-level persistence**). Under **BOD 22-01**, Federal Civilian Executive Branch (FCEB) agencies are required to remediate by CISA’s specified due dates, and CISA urged all organizations to prioritize remediation of KEV-listed issues as part of vulnerability management. CISA’s public KEV data repository was updated to reflect the new catalog release (catalog count increasing from **1522** to **1524**) and to include the new entries with their remediation deadlines (GitLab due **2026-03-11**; Dell RP4VMs due **2026-02-21**). Separate commentary and guidance from industry media emphasized using KEV as a prioritization input rather than a blanket “panic list,” recommending teams weigh exploitability and impact context (e.g., access prerequisites, remote control potential) and combine KEV with other signals such as **CVSS**, **EPSS**, and exploit/tooling intelligence to drive patch sequencing.
Jun 29, 2026
GitLab patched **CVE-2026-85706**, a CVSS 10.0 vulnerability in the repository commits API that lets unauthenticated remote attackers bypass path restrictions and read arbitrary files from vulnerable self-managed GitLab CE and EE servers. CISA added the flaw to its Known Exploited Vulnerabilities catalog, while public proof-of-concept material, Nuclei templates, scanning, and attempted exploitation have increased the risk that exposed instances could leak secrets, CI/CD credentials, and deployment material. Organizations should urgently upgrade to GitLab versions **19.1.8**, **19.2.6**, or **19.3.2**, as applicable, and review API request logs for traversal attempts against commit endpoints. The releases also remediate critical flaws including **CVE-2026-87719**, an authenticated GitLab EE Duo Chat unsafe-deserialization issue, alongside other high-severity bugs that can enable remote code execution, configuration changes, CI/CD-variable access, denial of service, or GraphQL authorization and CSRF attacks; defenders should treat a GitLab compromise as a potential software supply-chain incident.
Sep 19, 2026
GitLab Community Edition (CE) and Enterprise Edition (EE) updates address seven vulnerabilities, including the critical path-traversal flaw **CVE-2026-85706** and two critical CI/CD code-execution vulnerabilities, **CVE-2026-89078** and **CVE-2026-93577**. CVE-2026-85706 has a CVSS score of 10.0 and allows an unauthenticated remote attacker to read arbitrary files through the repository commits API because of improper path confinement and missing authentication enforcement. FortiGuard reported exploitation attempts across multiple countries and sectors, while CISA added the flaw to its Known Exploited Vulnerabilities catalog. The two CVSS 9.9 CI/CD flaws can allow an authenticated user to execute arbitrary code on the GitLab server under certain conditions using specially crafted regular expressions in CI/CD configuration. Self-managed GitLab administrators should upgrade immediately: versions 19.2 should move to **19.2.7** or later, 19.3 to **19.3.3** or later, and 19.4 to **19.4.1** or later; earlier fixes for CVE-2026-85706 were released in 19.1.8, 19.2.6, and 19.3.2. Organizations should also review repository commits API logs for suspicious requests, particularly attempts to retrieve configuration or credential files.
Sep 25, 2026