GitLab CI Lint API SSRF — CVE-2021-39935 Patch Bypass, CISA KEV Feb 2026, Cloud Metadata Theft, Internal Service Enumeration, 4-Year Exploitation Gap on Self-Managed Instances — Threadlinqs Intelligence
As of 2026-05-30, GitLab CI Lint API SSRF — CVE-2021-39935 Patch Bypass, CISA KEV Feb 2026, Cloud Metadata Theft, Internal Service Enumeration, 4-Year Exploitation Gap on Self-Managed Instances is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-0089 · Severity: HIGH · CVSS: 7.5 · Status: MONITORING · Category: VULNERABILITY
GitLab CE/EE CI Lint API Server-Side Request Forgery (SSRF) vulnerability (CVE-2021-39935) allows unauthenticated external users to perform server-side requests, enabling access to internal services,
CVE-2021-39935 is a Server-Side Request Forgery (SSRF) vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) affecting all versions from 10.5 through 14.5.1. The vulnerability exists in the CI Lint API endpoint, which validates CI/CD pipeline configuration (`.gitlab-ci.yml` files). Unauthorized external users can craft malicious CI configuration payloads that cause the GitLab server to make arbitrary HTTP requests to internal services, cloud provider metadata endpoints (169.254.169.254), and other restricted network resources.
The vulnerability is a patch bypass — an earlier SSRF in the CI Lint API was reported via HackerOne (report #1110131) and patched, but the fix was incomplete. Security researcher @minhli discovered that the access control enforcement could be circumvented in specific configurations. When GitLab instances have sign-ups enabled with the 'New users set to external' option, newly registered external users — who should have no project access and cannot trigger CI pipelines — can still abuse the CI Lint API to perform SSRF attacks without any project membership.
The CI Lint API (`/api/v4/ci/lint`) is designed to validate CI/CD YAML configuration before pipeline execution. The SSRF occurs because the validation process follows `include:` directives that reference remote URLs, allowing an attacker to specify arbitrary internal URLs. This enables:
1. **Cloud metadata theft**: Accessing AWS IMDSv1 (http://169.254.169.254/latest/meta-data/), GCP metadata, and Azure IMDS endpoints to steal IAM credentials, service account tokens, and instance identity documents
2. **Internal service enumeration**: Probing internal network services (Redis, PostgreSQL, Elasticsearch, Consul, Vault) for service discovery and data exfiltration
3. **Credential harvesting**: Accessing internal GitLab services (Gitaly, Workhorse, Rails console) that may expose tokens, API keys, or database credentials
4. **Network reconnaissance**: Mapping internal network topology by observing response timing and error messages from internal hosts
GitLab serves over 30 million registered users and is widely deployed as self-managed instances in enterprise environments, government agencies, and critical infrastructure organizations. Self-managed GitLab instances are particularly vulnerable because they often run within corporate networks with access to sensitive internal services. CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2026-02-03, indicating confirmed exploitation in the wild more than 4 years after the original patch was released — suggesting that many self-managed instances remain unpatched.
The vulnerability was patched in GitLab versions 14.5.2, 14.4.4, and 14.3.6, released on 2021-12-06. GitLab.com (the SaaS offering) was patched immediately. However, self-managed instances require manual upgrades, and the long tail of unpatched GitLab deployments represents significant ongoing risk. The current stable GitLab version is 18.8.4 (released 2026-02-10), meaning vulnerable instances are more than 3 years behind on patches.
The CISA KEV addition 4+ years post-patch highlights a critical pattern: legacy vulnerabilities in widely-deployed DevOps infrastructure continue to be actively exploited by threat actors who scan for unpatched self-managed instances. This mirrors the exploitation lifecycle of CVE-2021-22205 (GitLab Workhorse RCE, KEV since 2021-11-03) and CVE-2023-7028 (GitLab password reset takeover, KEV since 2024-05-01), confirming GitLab as a high-value target for persistent exploitation campaigns.
Target sectors: Technology, Government, Financial Services, Healthcare, Education, Critical Infrastructure, Defense
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2021-39935, T1595, T1190, T1552, T1528, T1016, T1046, T1580, T1018, T1082, T1213