🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2021-22175

6.8

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

Attack Vector

Network

Privileges Req.

None

User Interaction

None

gitlab

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

GitLab CI Lint API - Server-Side Request Forgery

GitLab 10.5 and later contain a server-side request forgery caused by insecure handling of webhook requests, letting unauthenticated attackers exploit the server for arbitrary requests, exploit requires sending crafted webhook requests. References: https://gitlab.com/gitlab-org/gitlab/-/issues/294178 https://nvd.nist.gov/vuln/detail/CVE-2021-22175 Remediation: Update to the latest version of GitLab where the vulnerability is fixed.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: gitlab

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →