Vulnerability Analysis
CVE-2021-39935
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
CISA KEV
CVSS Base Score
6.8
MEDIUM
Exploitability:2.3
Impact Score:4.0
Temporal Score:-
EPSS:30.50%
Threat Intelligence Signals
CISA KEV
YES
KEV Date Added
2026-02-03
Ransomware Use
Unknown
KEV Due Date
2026-02-24
VulnCheck In-the-Wild
No
Nuclei Template
No
EPSS Score
30.496%
EPSS Percentile
98.0th pct
GHSA ID
GitHub Severity
HIGH
SSVC Exploitation
—
SSVC Automatable
—
Vulnerability Class
—
Identity & Timeline
| Status | - |
| Assigning Authority | - |
| CVSS Version / Source | - |
| Reserved | - |
| Published | - |
| Patch Date (date_public) | - |
| Exploit DB Date | - |
| First GitHub PoC Date | - |
| Last Updated | - |
| Time to Patch (Days to fix) | - |
| Exploit Release Gap | - |
| PoC Release Gap | - |
| Exploit DB References | None identified |
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| No affected products specified. | ||
Social Buzz