GitLab · GitLab

CVE-2021-22175

GitLab Server-Side Request Forgery (SSRF) Vulnerability

Exploited in attacks Medium 6.8 Attack chance: 53%

What it is

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

CISA: GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: March 11, 2026

Added to the CISA list: February 18, 2026
Published: June 11, 2021
Severity: Medium 6.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 53% in the top 1.0% of all known vulnerabilities
Weakness: CWE-918
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from GitLab

Added	Vulnerability	Product	Severity	Attack chance
Sep 11, 2026	Path TraversalCVE-2026-85706	Community Edition and Enterprise Edition	Critical 10.0	97%
Feb 3, 2026	Server-Side Request Forgery (SSRF)CVE-2021-39935	Community and Enterprise Editions	Medium 6.8	36%
May 1, 2024	Community and Enterprise Editions Improper Access ControlCVE-2023-7028	GitLab CE/EE	Critical 10.0	94%
Nov 3, 2021	Remote Code ExecutionCVE-2021-22205used by ransomware	Community and Enterprise Editions	Critical 10.0	99.7%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.