CVE-2021-39913
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
All versions of GitLab CE/EE before 14.2.6, versions from 14.3 to 14.3.4, and versions from 14.4 to 14.4.1 accidentally log the system root password in migration logs. This allows an attacker with local file system access to obtain root-level privileges.
Risk Assessment
The organization is at risk of unauthorized access to the system, which could lead to serious security breaches and data loss.
Recommendation
It is recommended to upgrade GitLab to version 14.2.6 or later, and to monitor migration logs for potential abuse.
Other vulnerabilities in GitLab CE/EE
See all- CVE-2026-1659High
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.
- CVE-2026-93577Critical
GitLab CE/EE versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 contain an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration. Under certain conditions an authenticated user could execute arbitrary code on the GitLab server.
- CVE-2026-89078Critical
GitLab CE/EE versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 contain a double free issue when parsing a specially crafted regular expression in a CI/CD configuration. Under certain conditions an authenticated user could execute arbitrary code on the GitLab server.
- CVE-2023-7028CriticalActively exploited
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
- CVE-2023-3364High
An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. A Denial of Service (DoS) attack was possible via crafted payloads using AutolinkFilter at the preview_markdown endpoint.
- CVE-2021-39935MediumActively exploited
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API.
- CVE-2026-12664Medium
GitLab CE/EE versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 could, under certain conditions, allow an authenticated user with a read_api-scoped token to retrieve a project's incoming email address and create work items, bypassing token restrictions due to insufficient scope enforcement on a GraphQL field.
- CVE-2026-105777Medium
GitLab CE/EE versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 could, under certain conditions, allow an unauthenticated user to retrieve sensitive internal server credentials due to improper filtering of internal response headers.
- CVE-2026-105711Low
GitLab has remediated an issue in GitLab CE/EE affecting versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 where, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.
- CVE-2026-92883High
A vulnerability in GitLab CE/EE could, under certain conditions, allow an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository. Affects versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
Original NVD description (English source)
Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker with local file system access to obtain system root-level privileges
Vulnerability data from NVD (NIST) · CISA KEV · EPSS