UpHeron
All vulnerabilities

Servers and applications

CVE-2021-22175

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 18 Feb 2026.

Severity
Critical 9.8
Published
11 Jun 2021
Last changed
1 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
13.6.7, 13.7.7, 13.8.4
Sources
NVD

Affected software

SoftwareAffected versions
GitLabServers and applications · cpe:a:gitlab:gitlab
  • From 10.5.0 before 13.6.7
  • From 13.7.0 before 13.7.7
  • From 13.8.0 before 13.8.4

Known exploited

CISA name
GitLab Server-Side Request Forgery (SSRF) Vulnerability
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due for US agencies
11 Mar 2026
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-22175
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-22175