Home

Description

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

PUBLISHED Reserved 2021-01-05 | Published 2021-06-11 | Updated 2026-02-18 | Assigner GitLab




MEDIUM: 6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

CISA Known Exploited Vulnerability

Date added 2026-02-18 | Due date 2026-03-11

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Problem types

Server-side request forgery (ssrf) in GitLab

Product status

>=10.5, <13.6.7
affected

>=13.7, <13.7.7
affected

>=13.8, <13.8.4
affected

Credits

Thanks [@myster](https://hackerone.com/myster?type=user) for reporting this vulnerability through our HackerOne bug bounty program

References

gitlab.com/gitlab-org/gitlab/-/issues/294178

hackerone.com/reports/1059596

gitlab.com/...rg/cves/-/blob/master/2021/CVE-2021-22175.json

www.cisa.gov/...erabilities-catalog?field_cve=CVE-2021-22175 government-resource

gitlab.com/gitlab-org/gitlab/-/issues/294178

hackerone.com/reports/1059596

gitlab.com/...rg/cves/-/blob/master/2021/CVE-2021-22175.json

cve.org (CVE-2021-22175)

nvd.nist.gov (CVE-2021-22175)

Download JSON