Critical GitLab SSRF Vulnerability Under Active Exploitation, CISA Warns The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2021-39935, a severe server-side request forgery (SSRF) vulnerability in GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The flaw resides in GitLab’s CI Lint API, allowing unauthenticated attackers to manipulate the server into making unauthorized requests to internal systems. By exploiting this weakness, threat actors can bypass perimeter defenses, access restricted resources, and potentially move laterally within compromised networks. The vulnerability (tracked as CWE-918) poses risks including data exposure, supply chain compromise via CI/CD pipeline manipulation, and unauthorized access to cloud metadata or internal infrastructure. Both GitLab Community and Enterprise Editions are affected, with CISA’s inclusion in the KEV catalog underscoring the urgency of remediation. While no direct links to ransomware campaigns have been confirmed, the flaw’s potential for initial access makes it a prime target for advanced persistent threat (APT) groups and initial access brokers. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch (FCEB) agencies must patch or mitigate the vulnerability by February 24, 2026. Organizations unable to apply fixes are advised to discontinue use of affected GitLab instances until updates are available. GitLab has released patches, and administrators are urged to upgrade immediately, review CI Lint API configurations, and monitor logs for suspicious activity such as unusual API requests or unexpected internal connections originating from GitLab servers. Cloud-hosted GitLab users should adhere to BOD 22-01 guidance for securing cloud services. The incident highlights the growing threat of SSRF attacks, which can evade traditional security measures by leveraging trusted servers as proxies for malicious activity.