# CVE-2021-22175: GitLab - SSRF

> Live exploitation tracking for CVE-2021-22175 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-22175

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.8
- **Public exploit available:** Yes
- **Affected products:** GitLab
- **Weaknesses:** CWE-918 (Server-Side Request Forgery (SSRF))
- **Tags:** scm, cicd

## Description

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

## CrowdSec analysis

[CVE-2021-22175](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-22175) is a server-side request forgery (SSRF) vulnerability in GitLab, affecting all versions from 10.5 onward, that allows unauthenticated attackers to make unauthorized requests to internal network resources via webhooks—even when user registration is disabled. This flaw could be exploited to access sensitive internal services or data, potentially exposing critical infrastructure to further attacks.

CrowdSec has been tracking this vulnerability and its exploits since 13th of January 2026.

CrowdSec network observations suggest that most exploitation of CVE-2021-22175 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2021-22175. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit the `/api/v4/ci/lint` endpoint by sending crafted POST requests with malicious `include` directives, attempting to trigger server-side requests to attacker-controlled URLs.

## Timeline

- 2021-06-11: CVE Published. CVE-2021-22175 is published to NVD.
- 2026-01-13: Rule Released. CrowdSec releases a rule to detect CVE-2021-22175 exploitation attempts against the CrowdSec Network.
- 2026-01-14: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-22175 for the first time.
- 2026-02-18: CISA KEV. CVE-2021-22175 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-03-11: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://gitlab.com/gitlab-org/gitlab/-/issues/294178
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22175.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-22175) follows observed exploitation activity for CVE-2021-22175. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.