---
id: "CVE-2021-22175"
kind: "vulnerability"
aliases: ["CVE-2021-22175"]
title: "gitlab: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "GitLab GitLab", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "gitlab", "fixed": ["13.6.7"], "affected": ">= 10.5.0, < 13.6.7", "ecosystem": "vendor"}, {"name": "gitlab", "fixed": ["13.7.7"], "affected": ">= 13.7.0, < 13.7.7", "ecosystem": "vendor"}, {"name": "gitlab", "fixed": ["13.8.4"], "affected": ">= 13.8.0, < 13.8.4", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "gitlab", "self-hosted", "vendor"]
not_affected_if: ["default-config"]
published_at: "2021-06-11T16:15:09+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22175", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22175", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# gitlab: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in…

GitLab has a server-side request forgery flaw that is triggered when requests to the internal network for webhooks are enabled. An attacker can make the GitLab server send requests to internal hosts it can reach, which can expose internal services.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:GitLab GitLab affected ? fixed ?
- vendor:gitlab affected >= 10.5.0, < 13.6.7 fixed 13.6.7
- vendor:gitlab affected >= 13.7.0, < 13.7.7 fixed 13.7.7
- vendor:gitlab affected >= 13.8.0, < 13.8.4 fixed 13.8.4

## How to check

Check whether webhooks to the internal network are allowed in the GitLab admin settings (outbound requests / allow requests to the local network for webhooks and integrations).

## Fix

Apply the vendor mitigations or upgrade GitLab per the vendor advisory; CISA says to discontinue use if mitigations are unavailable.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22175
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-22175

## From the sources

GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_