Introduction
Attackers with authenticated access to GitLab can abuse webhook custom headers to make the server issue internal network requests, which may expose sensitive services and data. The flaw, tracked as CVE-2025-6454, affects a wide range of GitLab Community and Enterprise Edition deployments. It is rated high severity (CVSS 8.5) because it can enable lateral movement and expose internal resources in enterprise environments.
GitLab is a major DevOps platform used by millions of developers and organizations worldwide. Webhooks are central to its CI/CD workflows and third-party integrations, so vulnerabilities in this area hit the software development ecosystem especially hard.
Technical Information
CVE-2025-6454 is a server-side request forgery (SSRF) vulnerability in GitLab CE and EE. The flaw is in the webhook custom header feature, introduced in version 16.11. When users configure a webhook, they can specify custom HTTP headers to send with the outbound request. GitLab did not sufficiently validate or sanitize these header values.
Authenticated users (typically with Maintainer or Owner roles) could inject crafted sequences into custom headers. Where GitLab is deployed behind a proxy, those headers could be manipulated to alter request routing. The attacker can then force the GitLab server to send requests to internal network resources, cloud metadata endpoints, or other sensitive services that are not directly accessible from outside the network. Because the requests come from the GitLab server's trusted position inside the network, they bypass perimeter controls.
The attack requires authenticated access to a project or group with webhook configuration permissions. No public code snippets are available for this issue. The vulnerability is classified under CWE-918 (Server-Side Request Forgery).
Patch Information
The GitLab 18.3.2 security release fixed several critical vulnerabilities.
One fix addressed a cross-site scripting (XSS) vulnerability in the blob viewer. Attackers could inject malicious scripts into the viewer, which could lead to unauthorized actions on behalf of users. The patch added strict input validation and output encoding.
Another fix covered improper permission handling in the project API. Authenticated users with maintainer privileges could manipulate shared infrastructure resources beyond their intended access level and cause denial of service in other users' CI/CD pipelines. The fix tightened permission checks so users can only access resources within their authorized scope.
The release also resolved a cross-site scripting issue in labels. Authenticated users could inject malicious HTML into scoped label descriptions and trigger stored XSS. The patch sanitizes label descriptions so unauthorized scripts cannot execute.
These vulnerabilities could compromise user data and system integrity. Users are strongly encouraged to upgrade to version 18.3.2.
Patch source: GitLab 18.3.2 Security Release
Affected Systems and Versions
- GitLab Community Edition (CE) and Enterprise Edition (EE)
- All versions from 16.11 before 18.1.6
- 18.2 before 18.2.6
- 18.3 before 18.3.2
- Any configuration where users can configure webhooks with custom headers is potentially vulnerable
Vendor Security History
GitLab has fixed SSRF and webhook-related vulnerabilities before, many of them found through its active bug bounty program. It typically responds quickly, with coordinated patch releases and detailed advisories. SSRF issues keep recurring in webhook features, though, which shows how hard complex integration points are to secure. GitLab's transparency and engagement with the security community point to a mature security program, but the pattern still calls for continued vigilance.
