{"id":"CVE-2021-22175","kind":"vulnerability","aliases":["CVE-2021-22175"],"related":[],"title":"gitlab: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in…","description":"GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"GitLab has a server-side request forgery flaw that is triggered when requests to the internal network for webhooks are enabled. An attacker can make the GitLab server send requests to internal hosts it can reach, which can expose internal services.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-02-18T00:00:00+00:00","products":[{"name":"GitLab GitLab","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"gitlab","fixed":["13.6.7"],"affected":">= 10.5.0, < 13.6.7","ecosystem":"vendor"},{"name":"gitlab","fixed":["13.7.7"],"affected":">= 13.7.0, < 13.7.7","ecosystem":"vendor"},{"name":"gitlab","fixed":["13.8.4"],"affected":">= 13.8.0, < 13.8.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","gitlab","self-hosted","vendor"],"not_affected_if":["default-config"],"how_to_check":"Check whether webhooks to the internal network are allowed in the GitLab admin settings (outbound requests / allow requests to the local network for webhooks and integrations).","fix":"Apply the vendor mitigations or upgrade GitLab per the vendor advisory; CISA says to discontinue use if mitigations are unavailable.","status":"open","published_at":"2021-06-11T16:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:14+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-23T20:42:14Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations or upgrade GitLab per the vendor advisory; CISA says to discontinue use if mitigations are unavailable.\nunknown","reach":"internet","summary":"GitLab has a server-side request forgery flaw that is triggered when requests to the internal network for webhooks are enabled. An attacker can make the GitLab server send requests to internal hosts it can reach, which can expose internal services.","category":"vendor","who_cares":["gitlab","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reaches internal network services through the GitLab server.","analyst_note":"Find the GitLab advisory for CVE-2021-22175 to confirm affected and fixed versions and the exact mitigation setting; the KEV entry does not list them.","how_to_check":"Check whether webhooks to the internal network are allowed in the GitLab admin settings (outbound requests / allow requests to the local network for webhooks and integrations).\nunknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000456,"input_tokens":2525,"output_tokens":408,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':110C '-2021':20A,23A '-22175':21A,24A '22':109C 'action':100C 'appli':101C 'applic':107C 'attack':59B 'bod':108C 'cisa':98C 'cloud':113C 'contain':79C 'cve':19A,22A 'discontinu':116C 'enabl':11A,57B,97C 'exploit':30B 'expos':75B 'flaw':44B 'follow':106C 'forgeri':17A,43B,85C 'gitlab':1A,25A,26A,27A,28A,29A,31B,36B,63B,78C 'guidanc':111C 'host':34B,69B 'instruct':105C 'intern':6A,52B,68B,76B,92C 'make':61B 'mitig':102C,122C 'network':7A,53B,93C 'per':103C 'product':120C 'reach':72B 'request':3A,16A,42B,49B,66B,84C,89C 'requir':99C 'self':33B 'self-host':32B 'send':65B 'server':14A,40B,64B,82C 'server-sid':13A,39B,81C 'servic':77B,114C 'side':15A,41B,83C 'ssrf':86C 'trigger':47B 'unavail':124C 'use':117C 'vendor':35B,104C 'vulner':18A,87C 'webhook':9A,55B,95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-06-11T16:15:09+00:00","kev":{"dateAdded":"2026-02-18","dueDate":"2026-03-11","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-22175","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22175","severity":null,"published_at":"2026-02-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-22175","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22175","severity":null,"published_at":"2021-06-11T16:15:09+00:00","modified_at":"2026-10-01T19:17:14+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}