CISA Alert: GitLab exposes tens of thousands of instances and demands immediate CVE-2021-39935 SSRF patch

The United States Agency for Infrastructure and Cybersecurity (CISA) has given an ultimatum: federal agencies must park their GitLab instances for a vulnerability that was corrected years ago but is now being actively exploited in real environments. This is a SSRF (Server-Side Request Forgery) type failure known as CVE-2021-39935, which GitLab originally solved in December 2021.

In that correction, GitLab explained that the problem affected the CI Lint API, the tool that allows to validate and simulate CI / CD pipelines, and that in certain settings - when user registration was limited - outside users without privileges could run requests from the server. The original technical notice is available in GitLab's safety note of December 2021: GitLab Security Release (06-12-2021) and the details of the EQO can be found in the NVD database: CVE-2021-39935 (NVD).

What has rekindled the alarms is that CISA has included this vulnerability in its catalogue of known and exploited vulnerabilities in the real world, and has imposed a time limit on federal civil agencies to implement patches: three weeks since the notification, with a deadline of 24 February 2026, in accordance with the binding operational directive BOD 22-01. The CISA message is clear: these failures remain a frequent gateway for malicious actors and require immediate attention. The inclusion in the CISA catalogue is available here: CISA - CVE-2021-39935 alert, and the public list of exploited vulnerabilities is in: Known Exploited Vulnerabilities Catalog. The directive which requires action can also be reviewed on the CISA website on BOD 22-01: Binding Operational Directive 22-01.

Beyond the federal framework, CISA has urged private companies and organizations to prioritize mediation, because exposure is real and quantifiable. The Shodan connected device search engine shows tens of thousands of instances with GitLab's publicly accessible footprint: more than 49,000 results and almost 27,000 response by default in port 443, according to Shodan public searches. GitLab search in Shodan and results in port 443.

It is easy to see why the priority is high: GitLab is a very widespread platform in the world of development. The company declares tens of millions of users and an important presence among large companies, so a vulnerability in its management area and CI / CD has potential for massive impact. More information about GitLab's presence in the sector is on its corporate site: About GitLab.

What should technical and security officials do? The first step is obvious and urgent: to update to the corrected versions of GitLab, following the manufacturer's own instructions. If the update is not immediate, apply official mitigation, restrict access to exposed APIs and minimize public exposure are temporary measures necessary. It is also appropriate to audit records, to rotate credentials that may have been compromised and to review firewall rules and access controls to prevent internal services from receiving forced requests from exposed components.

In practice this may involve disabling public access to CI Lint API if not strictly necessary, deploying white IP lists, forcing enhanced authentication on administrative panels and monitoring unusual traffic patterns and pipelines executions. If a team detects suspicious activity and cannot mitigate the failure, the responsible option is to temporarily stop using the affected instance to apply the correction or move to a safe alternative.

The emergence of effective exploits against a corrected defect years ago recalls a classic lesson in cybersecurity: the corrections are effective only if applied. A patched vulnerability remains dangerous as long as unupdated facilities exist. CISA's pressure on federal entities seeks to reduce this gap, but the responsibility also lies with system managers and external suppliers to keep their development and continuous delivery environments up to date.

Finally, it is appropriate to place this episode in a broader context: this same week, CISA has been issuing several warnings and ordering patches for other critical failures exploited in the field. For security equipment this means prioritizing patch management, identifying exposed assets and establishing processes that shorten the time between the publication of a patch and its effective deployment.

If you want to read the official sources cited in this article, here are the main links: GitLab's note on correction ( GitLab - Security Release), the registration of the EVC in the NVD ( NVD - CVE-2021-39935), the CISA alert that incorporates vulnerability to the catalogue ( CISA - alert (03-02-2026)), the public list of exploited vulnerabilities ( KEV Catalog) and a view of the Shodan exhibition ( Shodan - GitLab).

The final recommendation is simple: do not trust that an old patch is no longer relevant. If your organization runs GitLab, check versions and apply the corrections as soon as possible. Industry and government agencies are doing it; now it's up to the rest.