EUVD-2026-67088
GHSA-827c-52wf-3g9x
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
PR:L confirmed by Duo Agent Platform role requirement; AC:H reflects crafted flow configuration needed; S:C due to GCP credential exfiltration beyond GitLab boundary.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, resulting in disclosure of Google Cloud Vertex cloud service credentials and private signing keys.
AnalysisAI
Server-Side Request Forgery (SSRF) in GitLab's AI Gateway component allows an authenticated user with Duo Agent Platform access to redirect outbound model requests to an attacker-controlled endpoint by injecting a crafted inline flow configuration that overrides the HTTP Host header. Exploitation results in exfiltration of Google Cloud Vertex cloud service credentials and private signing keys held by the AI Gateway, enabling an adversary to subsequently authenticate to GCP services outside GitLab's control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific conditions: first, the attacker must hold an authenticated GitLab account with the Duo Agent Platform role (PR:L per CVSS - not a default user role); second, that account must be able to submit or modify an inline flow configuration within the Duo Agent Platform, which is the injection point for the Host header override. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) accurately reflects the elevated risk: network-accessible, no user interaction, but requiring low-privileged credentials AND a specific role (Duo Agent Platform access), plus the crafting of a malicious inline flow configuration (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds a GitLab account with Duo Agent Platform access submits a crafted Duo agent inline flow configuration that replaces the HTTP Host header on an outbound Vertex AI model request with a hostname they control. When the AI Gateway processes the flow and sends the model request, it delivers the Google Cloud Vertex authentication credentials and private signing keys to the attacker's endpoint. … |
| Remediation | Upgrade the GitLab AI Gateway to a version beyond the vulnerable ranges. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all GitLab instances with AI Gateway and Duo Agent Platform enabled and immediately rotate all associated GCP service account credentials and signing keys; restrict network access to AI Gateway components to essential systems only using firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gitlab Ai Gateway
View allSame weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today