CVE-2021-22175

Medium6.8Published on June 11, 2021

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Feb 18, 2026
US federal agencies must remediate it by Mar 11, 2026 (BOD 22-01)
First attack observed 1368 days after disclosure
Confirmed by sensors, not only by reports

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Feb 18, 2026 Jan 14, 2026 Mar 11, 2025

CVSS score6.8 / 10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness type (CWE)CWE-918, CWE-918

Vendorsgitlab