GitLab Server-Side Request Forgery (SSRF) in Internal Network Webhooks (CVE-2021-22175)
Executive & SecOps Summary
SECOPS ASSESSMENTAll GitLab versions starting from 10.5 where internal network requests for webhooks are enabled
Unauthenticated attackers can bypass registration restrictions to trigger SSRF, accessing sensitive internal network resources and metadata
Upgrade to the latest patched GitLab version immediately, or disable the 'Allow requests to the local network from web hooks and services' setting
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your GitLab instance to the latest secure release. For Debian/Ubuntu-based systems, execute the following commands:
# Update package repository and upgrade GitLab CE/EE
sudo apt-get update
sudo apt-get install --only-upgrade gitlab-ce
# Reconfigure and restart GitLab services
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, disable local network requests from webhooks in /etc/gitlab/gitlab.rb:
# Ensure local network requests are disabled for webhooks and services
gitlab_rails['allow_local_requests_from_web_hooks_and_services'] = falseApply the configuration changes:
sudo gitlab-ctl reconfigure3. Log Audit & IoC Verification Commands
Verify your current GitLab version and inspect the application logs for potential SSRF exploitation attempts targeting internal IP addresses:
# Check current GitLab version
gitlab-rake gitlab:env:info | grep 'GitLab Version'
# Scan API logs for suspicious requests targeting loopback or metadata endpoints
sudo grep -E '127.0.0.1|169.254|localhost' /var/log/gitlab/gitlab-rails/api_json.logBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-22175) is a Server-Side Request Forgery (SSRF) in GitLab's webhook functionality. When the configuration allowing webhooks to make requests to the internal network is enabled, GitLab fails to properly validate and restrict destination addresses for unauthenticated requests. The root cause lies in insufficient access control and input validation on specific endpoints, allowing unauthenticated entities to trigger webhooks even when user registration is disabled.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker targets publicly accessible endpoints or exploits registration bypass vectors to trigger webhook events. By crafting malicious payloads containing internal IP addresses (such as loopback 127.0.0.1, private subnets, or cloud metadata endpoints like 169.254.169.254), the attacker forces the GitLab server to perform unauthorized HTTP requests. This allows the attacker to scan internal ports, read local services, or extract cloud instance credentials.
3. Infrastructure & Business Impact
Given its inclusion in the CISA KEV catalog and a high EPSS score, this vulnerability poses a severe threat. Successful exploitation can lead to full compromise of internal infrastructure, exposure of proprietary source code, and lateral movement within the cloud environment. Organizations running self-hosted GitLab instances exposed to the internet are at critical risk.
Official Vendor Advisories & References
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
Frequently Asked SecOps Questions (CVE-2021-22175)
FAQQ1. How critical is CVE-2021-22175 and is it actively exploited in the wild?
CVE-2021-22175 is rated CVSS 6.8 (MEDIUM) with a 30-day EPSS exploitation probability of 53.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-22175?
Primary impacted vendors include gitlab across gitlab. Scope summary: All GitLab Community Edition (CE) and Enterprise Edition (EE) versions starting from 10.5 prior to the patched releases
Q3. What temporary mitigations or workarounds exist for CVE-2021-22175 before patching?
[Mitigation] Upgrade to the latest patched GitLab version immediately, or disable the 'Allow requests to the local network from web hooks and services' setting Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-22175
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (gitlab)
View Category →GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Plex Media Server SSRF Vulnerability Advisory (CVE-2026-96655)
[Affected Scope] All Plex Media Server installations prior to version 1.43.3.10861
Plex Media Server SSRF Vulnerability Advisory (CVE-2026-96652) - Internal Network Pivoting and Request Forgery
[Affected Scope] All Plex Media Server installations prior to version 1.43.3.10861.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.