{"id":"gitlab-ssrf-exploited-flaw-feb-2026","category":"patch","status":"closed","title":"GitLab internal-network request flaw CVE-2021-22175 used in attacks; fixes available since 2021","tldr":"Attackers are exploiting an old GitLab flaw that lets people without a login make vulnerable servers contact internal systems. It affects certain old self-managed installations. Ask your IT team to update GitLab to a current supported security release.","summary":"CVE-2021-22175 affects GitLab Community Edition and Enterprise Edition servers with internal-network requests for webhooks enabled. Someone without a login can abuse its configuration-checking service to make requests into the network behind the server and potentially expose information, even when account registration is disabled. GitLab released fixes on 11 February 2021 in versions 13.6.7, 13.7.7 and 13.8.4. GreyNoise reported attack attempts in March 2025, and CISA added the flaw to its exploited-vulnerability catalogue on 18 February 2026. As at 3 November 2026, fixes remain available and CISA still lists ransomware involvement as unknown. The reviewed sources do not identify victims or establish when exploitation first began. Ratings differ: GitLab’s repository file gives medium/6.7; NVD displays GitLab’s submitted rating as medium/6.8 and its own as critical/9.8.","action":"If your business runs its own GitLab server, ask its IT team to update to a current supported security release; the original fixes were 13.6.7, 13.7.7 and 13.8.4. There is no phone or home-computer update for this server flaw.","product":"GitLab Community Edition and Enterprise Edition servers","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2021-22175"],"tags":["gitlab","ssrf","server","information-disclosure","actively-exploited"],"affected":["GitLab CE/EE >=10.5, <13.6.7","GitLab CE/EE >=13.7, <13.7.7","GitLab CE/EE >=13.8, <13.8.4","Exploitation requires internal-network requests for webhooks to be enabled."],"fixed":["GitLab CE/EE 13.6.7","GitLab CE/EE 13.7.7","GitLab CE/EE 13.8.4"],"matches":[],"sources":[{"kind":"advisory","title":"GitLab Security Release: 13.8.4, 13.7.7 and 13.6.7","url":"https://gitlab.com/gitlab-com/www-gitlab-com/-/raw/fba4fe7218170ad884e0366305f38bf22f928dcd/sites/marketing/source/releases/posts/2021-02-11-security-release-gitlab-13-8-4-released.html.md","by":"GitLab","date":"2021-02-11"},{"kind":"advisory","title":"GitLab CVE-2021-22175 record","url":"https://gitlab.com/gitlab-org/cves/-/raw/master/2021/CVE-2021-22175.json","by":"GitLab","date":"2021-06-11"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue, 3 November 2026 edition","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"research","title":"New SSRF Exploitation Surge Serves as a Reminder of 2019 Capital One Breach","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","by":"GreyNoise","date":"2025-03-11"},{"kind":"news","title":"U.S. CISA adds Dell RecoverPoint and GitLab flaws to its Known Exploited Vulnerabilities catalog","url":"https://securityaffairs.com/188243/hacking/u-s-cisa-adds-dell-recoverpoint-and-gitlab-flaws-to-its-known-exploited-vulnerabilities-catalog.html","by":"Security Affairs","date":"2026-02-19"},{"kind":"advisory","title":"CVE-2021-22175 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2021-22175","by":"NIST","date":"2026-10-01"}],"started":"2026-02-18","closed":"2026-02-18","created":"2026-11-03T22:28:48.011Z","updated":"2026-11-03T22:28:48.011Z","cve_notes":[{"cve":"CVE-2021-22175","name":"Unauthenticated SSRF in GitLab's CI Lint API","what":"A server-side request forgery flaw in GitLab’s CI Lint configuration-checking service lets an attacker without a login make requests to internal systems and potentially expose information when internal-network requests for webhooks are enabled.","severity":"medium","cvss":6.7}],"timeline":[{"at":"2026-02-18","added":"2026-11-03T22:23:50.754Z","kind":"cisa-added","text":"CISA added CVE-2021-22175 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. It set a remediation deadline of 11 March 2026 for US federal civilian agencies; use in ransomware campaigns was listed as unknown.","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2025-03-11","added":"2026-11-03T22:23:50.754Z","kind":"wider-attacks","text":"GreyNoise reported a surge of attack attempts on 9 March targeting several server-side request forgery flaws, including CVE-2021-22175. Its roughly 400 attacking IP addresses covered multiple flaws, rather than this GitLab vulnerability alone.","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","by":"GreyNoise","patch":null},{"at":"2021-02-11","added":"2026-11-03T22:23:50.754Z","kind":"new-fix","text":"GitLab disclosed CVE-2021-22175 and released fixes in Community Edition and Enterprise Edition 13.6.7, 13.7.7 and 13.8.4. The flaw allowed requests into internal networks without logging in when internal-network requests for webhooks were enabled.","url":"https://gitlab.com/gitlab-com/www-gitlab-com/-/raw/fba4fe7218170ad884e0366305f38bf22f928dcd/sites/marketing/source/releases/posts/2021-02-11-security-release-gitlab-13-8-4-released.html.md","by":"GitLab","patch":"patched"}],"url":"https://hard.fyi/live/gitlab-ssrf-exploited-flaw-feb-2026/","json":"https://hard.fyi/api/live?id=gitlab-ssrf-exploited-flaw-feb-2026"}