CVE-2021-22175 is a server-side request forgery (SSRF, CWE-918) in GitLab's webhook handling that affects all GitLab versions starting from 10.5. It is exploitable when the administrator setting that allows webhook and integration requests to the internal network is enabled, and an unauthenticated attacker can leverage it even on instances where self-registration is disabled, so no account or credentials are required. A successful attack makes the GitLab server issue requests to internal-network destinations, letting the attacker probe or interact with internal-only services reachable from the GitLab host (for example cloud metadata endpoints or internal APIs); the flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact. Self-managed GitLab deployments running an affected version with internal-network outbound requests enabled are the exposed population, while instances that are not internet-reachable or that keep that setting disabled are not reachable by this unauthenticated attack path. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-02-18, confirming in-the-wild exploitation; EPSS assigns a 53.4% probability of exploitation within 30 days (99th percentile), and related reporting describes coordinated SSRF exploitation involving more than 400 source IPs.
What to do: Upgrade self-managed GitLab to a current supported release; the fix shipped in GitLab 13.7.1 (with backports in 13.6.2 and 13.5.4), so any modern release already includes it, and federal agencies must meet BOD 22-01 timelines or discontinue use of unpatched versions. If patching must wait, check whether Admin Area → Settings → Network allows outbound requests to the internal network for web hooks and integrations, and disable that option or restrict the GitLab host's egress to internal ranges as an interim mitigation. Review webhook and GitLab host network logs for unexpected requests to internal services or cloud metadata endpoints (e.g., 169.254.169.254) that would indicate SSRF probing.
Affected
GitLab (self-managed Community and Enterprise editions)
all versions starting from 10.5 until the vendor fix; fixed in 13.7.1, with backports in 13.6.2 and 13.5.4 (per GitLab's security advisory)
Estimated exposure
largetens of thousands of internet-exposed self-managed GitLab instances; likely thousands to tens of thousands actually exploitable — Public internet-wide scans have historically surfaced tens of thousands of exposed GitLab servers, but the exploitable subset is limited to instances whose admins enabled outbound requests to the internal network for webhooks, while…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
CISA Known Exploited Vulnerability
Affected
GitLab GitLab
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
GitLab urges self-managed users to immediately patch a maximum-severity path traversal flaw (CVE-2023-2825) enabling unauthenticated arbitrary file reads.
GitLab released patches in CE/EE versions 19.3.2, 19.2.6, and 19.1 for CVE-2023-2825, a maximum-severity path traversal vulnerability that lets unauthenticated attackers read arbitrary files from vulnerable servers under certain conditions. The flaw, reported by researcher s3ntago via HackerOne, stems from improper path confinement and missing authentication enforcement in the repository commits API. GitLab also patched CVE-2026-87719, an insecure deserialization flaw in the GraphQL subscription serializer affecting Enterprise Edition users with Duo Chat access, which could expose credentials and Advanced Search configurations. GitLab.com and Dedicated customers are already protected; the platform has over 30 million registered users and is used by more than 50% of Fortune 100 companies.
CISA added max-severity GitLab CVE-2026-85706 to its exploited-flaws catalog after watchTowr observed probing of unpatched servers.
CISA added CVE-2026-85706, a maximum-severity GitLab flaw caused by missing authentication enforcement and improper path confinement in the repository commits API, to its actively exploited vulnerabilities catalog. Unauthenticated attackers can read credentials, secrets, and arbitrary files from vulnerable servers via a single HTTP request. GitLab patched the issue in CE/EE versions 19.3.2, 19.2.6, and 19.1, and federal agencies have three days to remediate under BOD 26-04. watchTowr reported in-the-wild probes for unpatched GitLab servers, and this is the fourth GitLab vulnerability CISA has tagged as actively exploited since November 2021.