CVE-2021-22175

CVE-2021-22175 is a server-side request forgery (SSRF, CWE-918) in GitLab's webhook handling that affects all GitLab versions starting from 10.5. It is exploitable when the administrator setting that allows webhook and integration requests to the internal network is enabled, and an unauthenticated attacker can leverage it even on instances where self-registration is disabled, so no account or credentials are required. A successful attack makes the GitLab server issue requests to internal-network destinations, letting the attacker probe or interact with internal-only services reachable from the GitLab host (for example cloud metadata endpoints or internal APIs); the flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact. Self-managed GitLab deployments running an affected version with internal-network outbound requests enabled are the exposed population, while instances that are not internet-reachable or that keep that setting disabled are not reachable by this unauthenticated attack path. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-02-18, confirming in-the-wild exploitation; EPSS assigns a 53.4% probability of exploitation within 30 days (99th percentile), and related reporting describes coordinated SSRF exploitation involving more than 400 source IPs.

What to do: Upgrade self-managed GitLab to a current supported release; the fix shipped in GitLab 13.7.1 (with backports in 13.6.2 and 13.5.4), so any modern release already includes it, and federal agencies must meet BOD 22-01 timelines or discontinue use of unpatched versions. If patching must wait, check whether Admin Area → Settings → Network allows outbound requests to the internal network for web hooks and integrations, and disable that option or restrict the GitLab host's egress to internal ranges as an interim mitigation. Review webhook and GitLab host network logs for unexpected requests to internal services or cloud metadata endpoints (e.g., 169.254.169.254) that would indicate SSRF probing.