CVE-2021-22175

GitLab Server-Side Request Forgery (SSRF) Vulnerability

6.8

CVSS

53.4%

EPSS (exploit prob.)

98.9%

EPSS percentile

Yes

Actively exploited

Ransomware use

2026-02-18

Added

Summary

GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.

Affected software

Vendor: GitLab · Product: GitLab

Weakness types (CWE):

What to do

This vulnerability appears in CISA's Known Exploited Vulnerabilities catalog, meaning it is being exploited in the wild. Prioritize patching affected systems and verify exposure across your estate.

Related vulnerabilities in GitLab

CVE	Name	EPSS	Exploited
CVE-2021-22205	GitLab Community and Enterprise Editions Remote Code Execution Vulnerability	99.7%	Yes
CVE-2023-7028	GitLab Community and Enterprise Editions Improper Access Control Vulnerability	94.6%	Yes
CVE-2021-39935	GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vuln	35.6%	Yes

Is your domain exposed?

Run a free, instant security report for any domain — exposure score, email auth, TLS and breach metadata.

Get your free report

All information is aggregated from public sources for awareness only and does not constitute an accusation or a security assessment. No personal data or credentials are published.