CVE-2021-22175

GitLab

Published 11 Jun 2021 · updated 1 Oct 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 18 Feb 2026, with a remediation deadline of 11 Mar 2026 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

References

gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json · Vendor Advisory
gitlab.com/gitlab-org/gitlab/-/issues/294178 · Exploit, Issue Tracking, Vendor Advisory
hackerone.com/reports/1059596 · Permissions Required, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22175 · US Government Resource