CISA: Hackers now exploit max severity GitLab flaw in attacks

CVE-2021-22175 is a server-side request forgery (SSRF, CWE-918) in GitLab's webhook handling that affects all GitLab versions starting from 10.5. It is exploitable when the administrator setting that allows webhook and integration requests to the internal network is enabled, and an unauthenticated attacker can leverage it even on instances where self-registration is disabled, so no account or credentials are required. A successful attack makes the GitLab server issue requests to internal-network destinations, letting the attacker probe or interact with internal-only services reachable from the GitLab host (for example cloud metadata endpoints or internal APIs); the flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact. Self-managed GitLab deployments running an affected version with internal-network outbound requests enabled are the exposed population, while instances that are not internet-reachable or that keep that setting disabled are not reachable by this unauthenticated attack path. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-02-18, confirming in-the-wild exploitation; EPSS assigns a 53.4% probability of exploitation within 30 days (99th percentile), and related reporting describes coordinated SSRF exploitation involving more than 400 source IPs.

Do: Upgrade self-managed GitLab to a current supported release; the fix shipped in GitLab 13.7.1 (with backports in 13.6.2 and 13.5.4), so any modern release already includes it, and federal agencies must meet BOD 22-01 timelines or discontinue use of unpatched versions. If patching must wait, check whether Admin Area → Settings → Network allows outbound requests to the internal network for web hooks and integrations, and disable that option or restrict the GitLab host's egress to internal ranges as an interim mitigation. Review webhook and GitLab host network logs for unexpected requests to internal services or cloud metadata endpoints (e.g., 169.254.169.254) that would indicate SSRF probing.

CVE-2021-39935 is a server-side request forgery (CWE-918) in GitLab Community Edition and Enterprise Edition that allows unauthorized external users to make the GitLab server issue requests through the CI Lint API. By abusing the server's network position, an attacker can reach internal-only resources such as loopback or private-network services, potentially mapping or accessing internal infrastructure without credentials. All deployments of the affected editions are potentially exposed, with actual risk depending on whether the CI Lint API is reachable by unauthenticated external users. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-03, indicating known exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed. EPSS estimates a 35.6% probability of exploitation within 30 days (98th percentile).

Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory for CVE-2021-39935 (version numbers are not provided in the source data). Until patching is complete, restrict unauthenticated external access to the CI Lint API (e.g., at the reverse proxy or firewall) and review logs for unexpected requests to loopback or internal-network targets originating from CI lint calls. Federal agencies must follow BOD 22-01 remediation timelines following the 2026-02-03 KEV listing; discontinue or isolate use if mitigations are unavailable.

CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed.

Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts.