NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

GitLab internal-network request flaw CVE-2021-22175 used in attacks; fixes available since 2021

Attackers are exploiting an old GitLab flaw that lets people without a login make vulnerable servers contact internal systems. It affects certain old self-managed installations. Ask your IT team to update GitLab to a current supported security release.

What to do

If your business runs its own GitLab server, ask its IT team to update to a current supported security release; the original fixes were 13.6.7, 13.7.7 and 13.8.4. There is no phone or home-computer update for this server flaw.

What’s happening

CVE-2021-22175 affects GitLab Community Edition and Enterprise Edition servers with internal-network requests for webhooks enabled. Someone without a login can abuse its configuration-checking service to make requests into the network behind the server and potentially expose information, even when account registration is disabled. GitLab released fixes on 11 February 2021 in versions 13.6.7, 13.7.7 and 13.8.4. GreyNoise reported attack attempts in March 2025, and CISA added the flaw to its exploited-vulnerability catalogue on 18 February 2026. As at 3 November 2026, fixes remain available and CISA still lists ransomware involvement as unknown. The reviewed sources do not identify victims or establish when exploitation first began. Ratings differ: GitLab’s repository file gives medium/6.7; NVD displays GitLab’s submitted rating as medium/6.8 and its own as critical/9.8.

What
Flaw
Affects
GitLab Community Edition and Enterprise Edition servers
Affected
GitLab CE/EE >=10.5, <13.6.7
GitLab CE/EE >=13.7, <13.7.7
GitLab CE/EE >=13.8, <13.8.4
Exploitation requires internal-network requests for webhooks to be enabled.
Fixed in
GitLab CE/EE 13.6.7
GitLab CE/EE 13.7.7
GitLab CE/EE 13.8.4
CVE
CVE-2021-22175
Since
18 Feb 2026
Closed
18 Feb 2026

Timeline

  1. CISA added

    CISA added CVE-2021-22175 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. It set a remediation deadline of 11 March 2026 for US federal civilian agencies; use in ransomware campaigns was listed as unknown.

  2. Wider attacks

    GreyNoise reported a surge of attack attempts on 9 March targeting several server-side request forgery flaws, including CVE-2021-22175. Its roughly 400 attacking IP addresses covered multiple flaws, rather than this GitLab vulnerability alone.

  3. New fixFixed

    GitLab disclosed CVE-2021-22175 and released fixes in Community Edition and Enterprise Edition 13.6.7, 13.7.7 and 13.8.4. The flaw allowed requests into internal networks without logging in when internal-network requests for webhooks were enabled.

Sources

  1. GitLab Security Release: 13.8.4, 13.7.7 and 13.6.7GitLab · 11 Feb 2021
  2. GitLab CVE-2021-22175 recordGitLab · 11 June 2021
  3. Known Exploited Vulnerabilities catalogue, 3 November 2026 editionCISA · 3 Nov 2026
  4. New SSRF Exploitation Surge Serves as a Reminder of 2019 Capital One BreachGreyNoise · 11 Mar 2025
  5. U.S. CISA adds Dell RecoverPoint and GitLab flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · 19 Feb 2026
  6. CVE-2021-22175 DetailNIST · 1 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS