CVE-2021-22175
GitLab Server-Side Request Forgery (SSRF) Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 11 March 2026). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 53.37% probability · 99th percentile
- CISA KEV
- Listed 18 February 2026 · due 11 March 2026
- Weakness
- CWE-918
- Affected
- gitlab/gitlab
- Source
- cve@gitlab.com
CISA notes
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json ; https://nvd.nist.gov/vuln/detail/CVE-2021-22175
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/294178Exploit, Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/1059596Permissions Required, Third Party Advisory
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.jsonVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/294178Exploit, Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/1059596Permissions Required, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22175US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.