GitLab AI Gateway CVE-2026-19889

Exploitation requires a valid GitLab account with Duo Agent Platform access - a role-specific entitlement, not granted to all authenticated users. The attacker must be able to submit AI model requests through the AI Gateway and must know or discover the specific model metadata fields that control endpoint routing. The CVSS AC:H metric indicates non-trivial craft is required, likely involving knowledge of internal API structure or bypassing partial input validation. Limiting factors: unauthenticated access is entirely blocked (PR:L enforced); GitLab instances where no users hold Duo Agent Platform access are not exploitable; deployments not configured to use Google Vertex AI or AWS Bedrock have reduced credential exposure though the SSRF path itself may still function. The HackerOne exploit reference suggests the specific crafting technique is no longer secret.

The CVSS 8.2 score with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N reflects a meaningful but access-gated threat. PR:L confirms exploitation requires an authenticated GitLab account with specific Duo Agent Platform entitlements - not any arbitrary internet user - which materially constrains the attacker pool. The AC:H metric indicates additional complexity in crafting the malicious metadata, likely requiring knowledge of internal model routing fields or bypassing partial validation. However, the Scope Change and C:H/I:H impact metrics are highly significant: successful exploitation yields live cloud provider credentials for Vertex AI or AWS Bedrock, enabling lateral movement entirely outside the GitLab environment. A publicly available exploit is referenced via HackerOne, elevating the practical risk above what AC:H alone might suggest. No EPSS data was provided, and the CVE is absent from CISA KEV, so widespread opportunistic exploitation is not confirmed - but the credential exfiltration impact means even targeted exploitation against a single organization could be catastrophic. The I:H rating likely reflects the attacker's ability to serve arbitrary model responses to end users by controlling the destination endpoint.

An authenticated GitLab user with Duo Agent Platform access submits an AI model request with crafted model metadata specifying an attacker-controlled HTTPS server as the model endpoint instead of a legitimate Vertex AI or Bedrock URL. The AI Gateway, without validating the destination, proxies the request - including cloud provider authentication headers or signed credentials - to the attacker's server, where they are logged and captured. The attacker then uses the harvested Vertex AI or AWS Bedrock credentials to access the victim organization's cloud AI environment, query models, or exfiltrate any data accessible to those credentials. A public exploit exists per the HackerOne report referenced as an exploit artifact.