GitLab · disclosed reports
Server-Side Request Forgery
18 disclosed reports · $19,750 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open GitLab on HackerOne- reports
- 18
- paid a bounty
- 5
Every one of the 18 is a mark on the map. Named now: 1 to 18, most upvoted first.
- SSRF on project import via the remote_attachment_url on a Note
- Server Side Request Forgery mitigation bypass
- Unauthenticated blind SSRF in OAuth Jira authorization controller
- Full Read SSRF on Gitlab's Internal Grafana
- GitLab::UrlBlocker validation bypass leading to full Server Side Request Forgery
- SSRF in CI after first run
- FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.com
- Injection of `http.<url>.*` git config settings leading to SSRF
- Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hook
- GitLab's GitHub integration is vulnerable to SSRF vulnerability
- CRLF injection & SSRF in git:// protocal lead to arbitrary code execution
- SSRF vulnerability in gitlab.com via project import.
- Blind SSRF in FogBugz project import
- SSRF In plantuml (on plantuml.pre.gitlab.com)
- SSRF into Shared Runner, by replacing dockerd with malicious server in Executor
- SSRF vulnerability in gitlab.com webhook
- Potensial SSRF via Git repository URL
- SSRF via git Repo by URL Abuse
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.