GitLab CVE-2021-22175: 2021 CI Lint SSRF Now in KEV

What to do

1. Find every self-managed GitLab and record its version (gitlab-rake gitlab:env:info or the VERSION file).
2. Upgrade anything on 13.x or older to a current supported release, following GitLab's upgrade path.
3. Clear 'Allow requests to the local network from webhooks and integrations' unless you need it, and use the allowlist instead.
4. Block the GitLab host from reaching the cloud metadata service and internal admin ports it has no business calling.
5. If an old instance was internet-facing, treat it as possibly compromised and review it before upgrading.

How to check if you are affected or compromised

• Search GitLab nginx and api_json logs for unauthenticated POST requests to /api/v4/ci/lint, especially in bursts from one source.
• Look for outbound connections from the GitLab server to 127.0.0.1 services, RFC 1918 addresses or 169.254.169.254 that line up with CI Lint calls.
• Check source IPs hitting the CI Lint endpoint against GreyNoise's gitlab-ce-ee-ssrf-attempt tag.

What happened#

In GitLab's February 11, 2021 security release (13.8.4, 13.7.7 and 13.6.7) was a fix titled "Unauthenticated CI lint API may lead to information disclosure and SSRF." The HackerOne-sourced issue explains it. GitLab's CI Lint API (/api/v4/ci/lint) accepted anonymous requests to validate pipeline YAML, and that YAML could pull in remote files with include: remote:. An unauthenticated attacker could therefore make the GitLab server fetch any URL. The reporter's proof of concept probed 127.0.0.1:9100 and read whether the port was open from the error message.

The CVE record limits the serious case: the bug was exploitable "when requests to the internal network for webhooks are enabled," on any version from 10.5, "even on a GitLab instance where registration is disabled." The record's CNA score is 6.8. NVD scores it 9.8, a rating that ignores that precondition.

Who is affected#

Self-managed GitLab CE and EE from 10.5 up to 13.6.7, 13.7.7 and 13.8.4, per GitLab's CVE data. Reaching internal hosts requires an admin to have enabled Allow requests to the local network from webhooks and integrations. GitLab's documentation says those requests are blocked by default. Without that setting, the reporter noted, the API could still probe outside hosts and reveal the server's real IP behind a CDN. Related unauthenticated SSRF bugs followed: CVE-2021-22214 (same precondition on limited-registration instances, fixed in 13.12.2, 13.11.5 and 13.10.5) and CVE-2021-39935 (CI Lint API, fixed in 14.5.2, 14.4.4 and 14.3.6). CISA added CVE-2021-39935 to KEV on February 3, 2026.

Do you really need to act?#

Only if you still run a very old GitLab. Every release since February 2021 has this fix. CISA added the CVE to KEV on February 18, 2026, with a March 11 deadline. CISA has not said what exploitation prompted the listing. The most specific public evidence is from GreyNoise. On March 9, 2025, it saw about 400 IPs exploiting 10 SSRF CVEs at once, including this one, a pattern it read as automation or pre-compromise reconnaissance. Coverage of the KEV addition, such as Security Affairs, names no campaign either.

The practical point: a server on 11.9 through 13.8.3 is also open to CVE-2021-22205, an unauthenticated RCE fixed in 13.8.8 that CISA lists with known ransomware use. An internet-facing GitLab on 13.8.3 or older should be upgraded or taken offline now, and investigated.

What to do now#

1. Check the version: sudo gitlab-rake gitlab:env:info or cat /opt/gitlab/embedded/service/gitlab-rails/VERSION.
2. Upgrade to a current supported release along GitLab's required upgrade path. See our September 2026 GitLab brief for current fixed versions.
3. Under Admin > Settings > Network > Outbound requests, clear the local-network option unless you need it, and list approved internal hosts in the allowlist instead.
4. Block the GitLab host from 169.254.169.254 (or enforce IMDSv2) and from internal admin ports.

How to tell if you were hit#

Search /var/log/gitlab/nginx/gitlab_access.log for POST /api/v4/ci/lint requests, and /var/log/gitlab/gitlab-rails/api_json.log for the same route with no authenticated user. Bursts from one source suggest scanning. Then correlate with outbound connections from the GitLab server to 127.0.0.1 services, RFC 1918 ranges or the metadata address. Check source IPs against GreyNoise's gitlab-ce-ee-ssrf-attempt tag. On any instance this old, also look for signs of CVE-2021-22205 exploitation, such as unknown admin users or unexpected processes run by the git user.

Timeline#

• Dec 15, 2020 — The issue is reported to GitLab through HackerOne.
• Feb 11, 2021 — GitLab releases 13.8.4, 13.7.7 and 13.6.7 with the fix.
• Jun 11, 2021 — CVE-2021-22175 is published.
• Mar 9, 2025 — GreyNoise observes a coordinated SSRF surge that includes this CVE.
• Feb 18, 2026 — CISA adds CVE-2021-22175 to KEV.
• Mar 11, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2021-22175 · KEV 2026-02-18 · When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. GitLab — Security Release: 13.8.4, 13.7.7 and 13.6.7 (archived copy) web.archive.org
2. GitLab — Issue 294178: Unauthenticated CI lint API may lead to information disclosure and SSRF gitlab.com
3. GitLab — CVE-2021-22175 CVE JSON gitlab.com
4. CVE record — CVE-2021-22175 cve.org
5. NVD — CVE-2021-22175 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2021-22175 cisa.gov
7. GitLab Docs — Filtering outbound requests (webhooks and integrations) docs.gitlab.com
8. GreyNoise — New SSRF exploitation surge serves as a reminder of 2019 Capital One breach greynoise.io

Coverage and analysis

1. Security Affairs — CISA adds Dell RecoverPoint and GitLab flaws to KEV securityaffairs.com