GitLab is affected by a critical SSRF vulnerability that is currently being actively exploited in the wild, posing a severe risk of internal data exfiltration.

This is a Server-Side Request Forgery (SSRF) flaw occurring within the webhook functionality of GitLab. The vulnerability permits an unauthenticated attacker to make requests to internal network services, even on instances where user registration is explicitly disabled.

The exploitation of this vulnerability allows unauthorized actors to interact with internal infrastructure that is otherwise protected from the public internet. Given the CVSS score of 9.5, this flaw represents a critical threat, potentially leading to the leakage of sensitive internal data, credential theft, or unauthorized access to backend services. The active exploitation status significantly increases the likelihood of a successful breach, which could result in severe reputational damage and significant operational disruption.

Immediate Action: Upgrade your GitLab instance to version 13.6.7, 13.7.7, 13.8.4, or a later patched release immediately.

Proactive Monitoring: Monitor network traffic logs for anomalous requests originating from the GitLab server toward internal network endpoints, specifically looking for unexpected webhook-related activity.

Compensating Controls: Implement strict egress filtering on the GitLab server to prevent it from initiating connections to sensitive internal network segments or unauthorized external endpoints.

Public Exploit Available: Yes, a public exploit is available via Nuclei templates and documented proof-of-concept research.

Due to the critical severity of this vulnerability and the confirmed reports of active exploitation, immediate patching is required. Organizations must prioritize the update of all affected GitLab instances to the specified patched versions to neutralize this threat. Delaying this remediation leaves your infrastructure exposed to active, high-impact exploitation attempts.