CVE Watch1 oct 2026

CVE-2021-22175

GitLab Server-Side Request Forgery (SSRF) Vulnerability

CVSS

6.8

Medio

EPSS

53.4%

p99

KEV

SÍ

18 feb 2026

Exploit Today

0-100

Publicado: 11 jun 2021 · Última mod.: 1 oct 2026 · CWE-918

EPSS · 30d

53.4%EPSS · 30 días53.4%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

GitLab / GitLab

Vulnerabilidad

GitLab Server-Side Request Forgery (SSRF) Vulnerability

Añadido a KEV

18 feb 2026

Remediar antes de

11 mar 2026

Uso conocido en ransomware

Descripción resumida

GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json ; https://nvd.nist.gov/vuln/detail/CVE-2021-22175

Descripción técnica

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-37127.3 ALT

—

———The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.6h CVE-2026-1108688.5 ALT

—

——0Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.12h CVE-2026-0311—

—

——0A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.14h CVE-2026-553856.8 MED

—

——0InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0.15h CVE-2026-557877.1 ALT

—

——0Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses. An authenticated workflow author can provide a transition-form literal URL through the Execution API POST /v1/execute route, http.get, or sibling guarded outbound-request modules, causing the guard to accept an address whose embedded IPv4 points to loopback, RFC 1918, or cloud metadata services. On a host that routes the selected transition form, the outbound request reaches the internal destination and returns the response body to the workflow caller, enabling read SSRF and disclosure of internal-service data or cloud credentials. This issue is fixed in version 2.26.3.16h CVE-2026-1023546.8 MED

—

——0BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), as used by isValidCertificateUrl() and isValidTsaUrl(), separately from the outbound fetch(targetUrl, ...). In deployments where PROXY_SECRET validation is not enabled, a direct client that controls authoritative DNS can forge the Origin header, supply a certificate, OCSP, CRL, or TSA URL that passes the proxy's accepted path checks, return a public address during validation, and return a private or link-local address during the later fetch. The endpoint can return allowed response bodies to the attacker, but exploitation requires precise timing, redirects and IP-literal obfuscation are blocked, and network reachability limits the target. This vulnerability is fixed in 2.8.7.16h