GitLab Server-Side Request Forgery (SSRF) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 18/02/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| gitlab | ≥ 10.5.0, < 13.6.7≥ 13.7.0, < 13.7.7≥ 13.8.0, < 13.8.4 | 13.6.713.7.713.8.4 |
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free