CVE-2021-22175
critical CISA KEVGitLab Server-Side Request Forgery (SSRF) Vulnerability
Vendor / product: GitLab — GitLab
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2021-06-11 16:15
Modified: 2026-10-01 19:17
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Listed in CISA KEV
Added 2026-02-18 · due 2026-03-11
Known ransomware use: Unknown
Required action (CISA)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
gitlab / gitlab ≥10.5.0 <13.6.7, ≥13.7.0 <13.7.7, ≥13.8.0 <13.8.4
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://gitlab.com/gitlab-org/gitlab/-/issues/294178
Vendor advisory: https://gitlab.com/gitlab-org/gitlab/-/issues/294178
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json cve@gitlab.com
- https://gitlab.com/gitlab-org/gitlab/-/issues/294178 cve@gitlab.com
- https://hackerone.com/reports/1059596 cve@gitlab.com
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json af854a3a-2127-422b-91ae-364da2661108
- https://gitlab.com/gitlab-org/gitlab/-/issues/294178 af854a3a-2127-422b-91ae-364da2661108
- https://hackerone.com/reports/1059596 af854a3a-2127-422b-91ae-364da2661108
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22175 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
CISA KEV — fetched 2026-10-27 06:50 UTC · record ↗
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗