CVE-2021-22175: GitLab SSRF in internal network webhooks

CVE-2021-22175 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-02-18

GitLab, a widely used platform for software development and collaboration, contains a vulnerability that allows unauthorized individuals to trick the server into making requests to internal systems. This could allow an attacker to bypass network security controls and access sensitive internal data or services that are not intended to be public. This issue is particularly serious as it can be exploited even on GitLab instances where user registration is disabled.

Technologies: GitLab. Vendors: GitLab.

Quick answers

Is CVE-2021-22175 exploited in the wild?
Yes. CVE-2021-22175 is known to be exploited in the wild, first recorded on 18 February 2026. Treat it as urgent.
How severe is CVE-2021-22175?
Critical severity, with a CVSS score of 9.8, published 18 February 2026.
Which products and versions are affected?
GitLab 10.5.0 to 13.6.7, 13.7.0 to 13.7.7, 13.8.0 to 13.8.4.
Is there a fix for CVE-2021-22175?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-22175 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2021-22175?
Check whether you run GitLab at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in GitLab affecting versions starting from 10.5. The flaw occurs when the 'requests to the internal network for webhooks' setting is enabled. An unauthenticated remote attacker can exploit this to force the GitLab server to send requests to internal network resources. This can be used to bypass firewall restrictions, perform internal port scanning, or interact with internal services that lack authentication. The vulnerability is exploitable even if user registration is disabled on the instance. Patches were released in versions 13.6.7, 13.7.7, and 13.8.4.

Affected products

  • GitLab GitLab 10.5.0 to 13.6.7, 13.7.0 to 13.7.7, 13.8.0 to 13.8.4

Timeline

  • 2021-06-11: disclosed: Initial NVD publication date
  • 2026-02-18: kev added: Added to CISA Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.