DaystoPatch

GitLabExploited incident

GitLab unauthenticated server-side request forgery via webhooks / CI lint API (2021)

CVE-2021-22175Medium, CVSS 6.8In CISA's Known Exploited Vulnerabilities catalog since 18 Feb 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    GitLab Security Release: 13.8.4, 13.7.7 and 13.6.7 (Feb 11, 2021; Wayback snapshot)CuratedQuote verified

    When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled.

    Coordinated disclosure: the security release post dated Feb 11, 2021 was the first public signal (the CVE ID was assigned later; the CVE record was published 2021-06-11). Exploitation was only reported years later (KEV listing 2026-02-18).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ba81507ffe9bf783…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CVE.org record CVE-2021-22175ClaimedQuote verified11 Jun 2021, 15:30 UTC

    When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:db56caf5b991a700…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet12 Mar 2025, 21:01 UTC

    CVE-2021-22175 has confirmed exploit code according to the following sources: Vulncheck KEV.

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2021-22175)ClaimedQuote verified18 Feb 2026

    GitLab Server-Side Request Forgery (SSRF) Vulnerability

    Added to CISA's KEV catalog on 2026-02-18.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet20 Feb 2026, 00:00 UTC

    🚨 [CISA-2026:0218] CISA Adds 2 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:0218 ) CISA has added 2 new vulnerabilities to its Known

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    GitLab Security Release: 13.8.4, 13.7.7 and 13.6.7 (Feb 11, 2021; Wayback snapshot)CuratedQuote verified

    Today we are releasing versions 13.8.4, 13.7.7 and 13.6.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

    Post header reads 'Feb 11, 2021'. The original about.gitlab.com URL now redirects to a docs index, so the Wayback snapshot captured on 2021-02-11 is cited.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ba81507ffe9bf783…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    GitLab Security Release: 13.8.4, 13.7.7 and 13.6.7 (Feb 11, 2021; Wayback snapshot)CuratedQuote verified

    Today we are releasing versions 13.8.4, 13.7.7 and 13.6.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ba81507ffe9bf783…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    GitLab Security Release: 13.8.4, 13.7.7 and 13.6.7 (Feb 11, 2021; Wayback snapshot)CuratedQuote verified

    Today we are releasing versions 13.8.4, 13.7.7 and 13.6.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

    All three then-supported branches fixed at once; GitLab's CVE record lists affected ranges >=10.5 <13.6.7, >=13.7 <13.7.7, >=13.8 <13.8.4 (https://gitlab.com/gitlab-org/cves/-/raw/master/2021/CVE-2021-22175.json).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ba81507ffe9bf783…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • GitLab Community Edition (CE)
  • GitLab Enterprise Edition (EE)
How we built this timeline

Old bug added to KEV long after the fix (KEV 18 Feb 2026). The release post section is titled 'Unauthenticated CI lint API may lead to information disclosure and SSRF'.

Severity follows GitLab's own CVSS 3.1 score 6.8 (medium); NVD scores it 9.8.

Related later fix: gitlab-cve-2021-39935 (CI Lint API SSRF for external users, December 2021).

Related

GitLab report card