---
id: CVE-2021-22175
title: >-
  When requests to the internal network for webhooks are enabled, a server-side
  request forgery vulnerability in GitLab affecting all versions starting from
  10.5 was possible to exploit for an unauthenticated attacker even on a GitLab
  inst…
summary: >-
  When requests to the internal network for webhooks are enabled, a server-side
  request forgery vulnerability in GitLab affecting all versions starting from
  10.5 was possible to exploit for an unauthenticated attacker even on a GitLab
  inst…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-918
vendor: gitlab
product: gitlab
affected:
  - 'gitlab >= 10.5.0, < 13.6.7'
  - 'gitlab >= 13.7.0, < 13.7.7'
  - 'gitlab >= 13.8.0, < 13.8.4'
patched:
  - gitlab 13.8.4
published: '2021-06-11'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T19:17:14.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-22175'
references:
  - url: 'https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json'
    label: cve@gitlab.com
  - url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/294178'
    label: cve@gitlab.com
  - url: 'https://hackerone.com/reports/1059596'
    label: cve@gitlab.com
  - url: 'https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/294178'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://hackerone.com/reports/1059596'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22175
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
  - cve.org
epss: 0.53372
epssPercentile: 0.98981
kev: true
kevDateAdded: '2026-02-18'
kevDueDate: '2026-03-11'
kevRansomware: false
exploited: true
exploits:
  nuclei:
    - CVE-2021-22175
  checkedAt: '2026-10-27T16:39:23.954Z'
exploitAvailable: true
ssvc:
  exploitation: active
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-02-19T04:55:37.706988Z'
ingestedAt: '2026-10-01T18:55:42.393Z'
---

## Overview

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

## Affected

- `gitlab >= 10.5.0, < 13.6.7`
- `gitlab >= 13.7.0, < 13.7.7`
- `gitlab >= 13.8.0, < 13.8.4`

## Remediation

Upgrade past the affected range:

- `gitlab 13.8.4`