---
title: "GitLab CVE-2021-22175: 2021 CI Lint SSRF Now in KEV"
url: https://erroneo.us/security/briefs/gitlab-ci-lint-ssrf-cve-2021-22175-kev/
description: "Unauthenticated SSRF via GitLab's CI Lint API when local-network webhooks are allowed; fixed in 13.8.4, 13.7.7, 13.6.7 in 2021. KEV in 2026. Find stale servers."
type: security-brief
section: "Security Digest"
date_published: 2021-02-11
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2021-22175"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# GitLab CVE-2021-22175: 2021 CI Lint SSRF Now in KEV

**Verdict: Check exposure.** Any GitLab patched since early 2021 is fine; a self-managed instance still on 13.8.3 or older is years out of date, open to this SSRF and worse bugs, and should be upgraded or pulled offline now.

- **Who must act:** Owners of self-managed GitLab CE/EE 10.5 through 13.8.3, especially where an admin enabled local-network requests for webhooks and integrations.
- **Who can relax:** Instances on any 2021-or-later release (13.8.4, 13.7.7, 13.6.7 or newer), and current, supported GitLab installs, which carry this and the later CI Lint SSRF fixes.
- **Affected:** GitLab CE/EE 10.5 before 13.6.7; GitLab CE/EE 13.7 before 13.7.7; GitLab CE/EE 13.8 before 13.8.4; Exploitable when 'Allow requests to the local network from webhooks and integrations' is enabled
- **Fixed:** GitLab 13.6.7, 13.7.7 and 13.8.4 (Feb 11, 2021); Any current supported GitLab release
- **CVEs:** CVE-2021-22175
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every self-managed GitLab and record its version (gitlab-rake gitlab:env:info or the VERSION file).
2. Upgrade anything on 13.x or older to a current supported release, following GitLab's upgrade path.
3. Clear 'Allow requests to the local network from webhooks and integrations' unless you need it, and use the allowlist instead.
4. Block the GitLab host from reaching the cloud metadata service and internal admin ports it has no business calling.
5. If an old instance was internet-facing, treat it as possibly compromised and review it before upgrading.

### How to check if you are affected

- Search GitLab nginx and api_json logs for unauthenticated POST requests to /api/v4/ci/lint, especially in bursts from one source.
- Look for outbound connections from the GitLab server to 127.0.0.1 services, RFC 1918 addresses or 169.254.169.254 that line up with CI Lint calls.
- Check source IPs hitting the CI Lint endpoint against GreyNoise's gitlab-ce-ee-ssrf-attempt tag.

## What happened

In GitLab's [February 11, 2021 security release](https://web.archive.org/web/2021/https://about.gitlab.com/releases/2021/02/11/security-release-gitlab-13-8-4-released/) (13.8.4, 13.7.7 and 13.6.7) was a fix titled "Unauthenticated CI lint API may lead to information disclosure and SSRF." The [HackerOne-sourced issue](https://gitlab.com/gitlab-org/gitlab/-/issues/294178) explains it. GitLab's CI Lint API (`/api/v4/ci/lint`) accepted anonymous requests to validate pipeline YAML, and that YAML could pull in remote files with `include: remote:`. An unauthenticated attacker could therefore make the GitLab server fetch any URL. The reporter's proof of concept probed `127.0.0.1:9100` and read whether the port was open from the error message.

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2021-22175) limits the serious case: the bug was exploitable "when requests to the internal network for webhooks are enabled," on any version from 10.5, "even on a GitLab instance where registration is disabled." The record's CNA score is 6.8. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-22175) scores it 9.8, a rating that ignores that precondition.

## Who is affected

Self-managed GitLab CE and EE from 10.5 up to 13.6.7, 13.7.7 and 13.8.4, per GitLab's [CVE data](https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json). Reaching internal hosts requires an admin to have enabled *Allow requests to the local network from webhooks and integrations*. GitLab's [documentation](https://docs.gitlab.com/security/webhooks/) says those requests are blocked by default. Without that setting, the reporter noted, the API could still probe outside hosts and reveal the server's real IP behind a CDN. Related unauthenticated SSRF bugs followed: CVE-2021-22214 (same precondition on limited-registration instances, fixed in 13.12.2, 13.11.5 and 13.10.5) and CVE-2021-39935 (CI Lint API, fixed in 14.5.2, 14.4.4 and 14.3.6). CISA added CVE-2021-39935 to KEV on February 3, 2026.

## Do you really need to act?

Only if you still run a very old GitLab. Every release since February 2021 has this fix. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22175) on February 18, 2026, with a March 11 deadline. CISA has not said what exploitation prompted the listing. The most specific public evidence is from [GreyNoise](https://www.greynoise.io/blog/new-ssrf-exploitation-surge). On March 9, 2025, it saw about 400 IPs exploiting 10 SSRF CVEs at once, including this one, a pattern it read as automation or pre-compromise reconnaissance. Coverage of the KEV addition, such as [Security Affairs](https://securityaffairs.com/188243/hacking/u-s-cisa-adds-dell-recoverpoint-and-gitlab-flaws-to-its-known-exploited-vulnerabilities-catalog.html), names no campaign either.

The practical point: a server on 11.9 through 13.8.3 is also open to CVE-2021-22205, an unauthenticated RCE fixed in 13.8.8 that CISA lists with known ransomware use. An internet-facing GitLab on 13.8.3 or older should be upgraded or taken offline now, and investigated.

## What to do now

1. Check the version: `sudo gitlab-rake gitlab:env:info` or `cat /opt/gitlab/embedded/service/gitlab-rails/VERSION`.
2. Upgrade to a current supported release along GitLab's required upgrade path. See our [September 2026 GitLab brief](https://erroneo.us/security/briefs/gitlab-commits-api-file-read-cve-2026-85706/) for current fixed versions.
3. Under Admin > Settings > Network > Outbound requests, clear the local-network option unless you need it, and list approved internal hosts in the allowlist instead.
4. Block the GitLab host from `169.254.169.254` (or enforce IMDSv2) and from internal admin ports.

## How to tell if you were hit

Search `/var/log/gitlab/nginx/gitlab_access.log` for `POST /api/v4/ci/lint` requests, and `/var/log/gitlab/gitlab-rails/api_json.log` for the same route with no authenticated user. Bursts from one source suggest scanning. Then correlate with outbound connections from the GitLab server to `127.0.0.1` services, RFC 1918 ranges or the metadata address. Check source IPs against GreyNoise's `gitlab-ce-ee-ssrf-attempt` tag. On any instance this old, also look for signs of CVE-2021-22205 exploitation, such as unknown admin users or unexpected processes run by the `git` user.

## Timeline

- Dec 15, 2020 — The issue is reported to GitLab through HackerOne.
- Feb 11, 2021 — GitLab releases 13.8.4, 13.7.7 and 13.6.7 with the fix.
- Jun 11, 2021 — CVE-2021-22175 is published.
- Mar 9, 2025 — GreyNoise observes a coordinated SSRF surge that includes this CVE.
- Feb 18, 2026 — CISA adds CVE-2021-22175 to KEV.
- Mar 11, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [GitLab — Security Release: 13.8.4, 13.7.7 and 13.6.7 (archived copy)](https://web.archive.org/web/2021/https://about.gitlab.com/releases/2021/02/11/security-release-gitlab-13-8-4-released/)
2. [GitLab — Issue 294178: Unauthenticated CI lint API may lead to information disclosure and SSRF](https://gitlab.com/gitlab-org/gitlab/-/issues/294178)
3. [GitLab — CVE-2021-22175 CVE JSON](https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json)
4. [CVE record — CVE-2021-22175](https://www.cve.org/CVERecord?id=CVE-2021-22175)
5. [NVD — CVE-2021-22175](https://nvd.nist.gov/vuln/detail/CVE-2021-22175)
6. [CISA — Known Exploited Vulnerabilities: CVE-2021-22175](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22175)
7. [GitLab Docs — Filtering outbound requests (webhooks and integrations)](https://docs.gitlab.com/security/webhooks/)
8. [GreyNoise — New SSRF exploitation surge serves as a reminder of 2019 Capital One breach](https://www.greynoise.io/blog/new-ssrf-exploitation-surge)
9. [Security Affairs — CISA adds Dell RecoverPoint and GitLab flaws to KEV](https://securityaffairs.com/188243/hacking/u-s-cisa-adds-dell-recoverpoint-and-gitlab-flaws-to-its-known-exploited-vulnerabilities-catalog.html)

---
Source page: https://erroneo.us/security/briefs/gitlab-ci-lint-ssrf-cve-2021-22175-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt