EUVD-2026-67088
GHSA-827c-52wf-3g9x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Duo Agent Platform access
-
DeliveryCraft inline flow config overriding Host header
-
ExploitAI Gateway sends model request to attacker endpoint
-
ExecutionCapture Vertex credentials and signing keys
-
ImpactReuse stolen keys against Google Cloud
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated GitLab user who has access to the Duo Agent Platform and the ability to supply an inline flow configuration; the specific abused mechanism is overriding the outbound HTTP Host header in that flow config to redirect model requests. Exploitation is limited to environments where the AI Gateway (versions 18.10-19.0.11, 19.1-19.1.6, or 19.2-19.2.1) is deployed with the Duo Agent Platform enabled, and it needs valid platform access (PR:L) - it is not exploitable by fully unauthenticated outsiders. No user interaction beyond the attacker's own actions is required (UI:N). |
| Impact | Signals are mixed but lean toward prioritized patching where the component is deployed. CVSS 3.1 is 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reflecting network reach, low complexity, and a scope-changing credential leak, and SSVC rates Technical Impact as total. However, exploitation requires an authenticated user with Duo Agent Platform access (PR:L), and SSVC marks Automatable: no, meaning it is not a mass-scannable or wormable flaw. EPSS is low (0.19%, 9th percentile) and it is not in CISA KEV, so there is no evidence of widespread active exploitation despite the public POC. Note the I:H in the vendor vector is arguably generous - the described outcome is credential/key disclosure (confidentiality) rather than direct data tampering; treat integrity impact as derived from potential downstream misuse of stolen credentials rather than confirmed. Net: a real priority for GitLab operators running the AI Gateway with Duo, but the low EPSS plus authentication requirement argue against panic-level urgency. |
| Exploit ScenarioDerived | An authenticated user with Duo Agent Platform access crafts an inline flow configuration that overrides the outbound HTTP Host header, pointing the Gateway's model request at a server they control. When the Gateway sends its authenticated request, it delivers the Google Cloud Vertex credentials and private signing keys to the attacker's endpoint. A public exploit report exists on HackerOne (#3945100), and the low attack complexity (AC:L) makes reliable reproduction straightforward for anyone with the required access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 01, 2026
Server-side request forgery in the GitLab AI Gateway (Duo Agent Platform) lets an authenticated user redirect outbound model requests to an attacker-controlled endpoint by supplying a crafted inline flow configuration that overrides the HTTP Host header, exfiltrating Google Cloud Vertex service credentials and private signing keys. It affects AI Gateway 18.10 through 19.0.11, 19.1 through 19.1.6, and 19.2 through 19.2.1. Publicly available exploit code exists (HackerOne #3945100); EPSS is low at 0.19% and it is not in CISA KEV.
Earlier versions of this analysis (1)
Server-Side Request Forgery (SSRF) in GitLab's AI Gateway component allows an authenticated user with Duo Agent Platform access to redirect outbound model requests to an attacker-controlled endpoint by injecting a crafted inline flow configuration that overrides the HTTP Host header. Exploitation results in exfiltration of Google Cloud Vertex cloud service credentials and private signing keys held by the AI Gateway, enabling an adversary to subsequently authenticate to GCP services outside GitLab's control. No public exploitation (CISA KEV) has been confirmed, but a publicly available exploit exists via a disclosed HackerOne report, materially increasing real-world risk.
RemediationAI
Patch available per vendor advisory: upgrade GitLab AI Gateway to 19.0.12, 19.1.7, or 19.2.2 (or later) depending on your branch, as bounded by the affected-version data. If immediate patching is not possible, restrict who holds Duo Agent Platform access to shrink the authenticated attacker population, and where feasible restrict or monitor the AI Gateway's outbound network egress so it can only reach legitimate Google Vertex endpoints (egress allow-listing blocks redirection to attacker hosts but may break other outbound integrations and must be validated against your model routing). Rotate any Google Cloud Vertex service-account credentials and signing keys that may have been exposed on unpatched systems. Reference the GitLab work item https://gitlab.com/gitlab-org/gitlab/-/work_items/616990 and exploit report https://hackerone.com/reports/3945100.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is cpe:2.3:a:gitlab:gitlab_ai_gateway, the service that proxies GitLab Duo AI requests to backend model providers such as Google Cloud Vertex AI. The root cause is CWE-918 (Server-Side Request Forgery): the Duo Agent Platform's inline flow configuration allows a user to influence the outbound HTTP Host header, so the Gateway can be coerced into sending its authenticated model requests - which carry Vertex cloud credentials and private signing keys used to authenticate to Google's API - to an externally-controlled destination instead of the legitimate Vertex endpoint. Because the leaked material belongs to a separate cloud system (Google Cloud), the CVSS scope is marked Changed.
Know when Gitlab Ai Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Authenticated Duo access gives PR:L; scope changes (S:C) as Google Cloud credentials leak to another system; C:H for key disclosure, I:L for possible response manipulation, A:N.
Primary rating from Vendor (GitLab).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, resulting in disclosure of Google Cloud Vertex cloud service credentials and private signing keys.
Executive ViewAI
GitLab AI Gateway versions 18.10-19.2.1 contain a server-side request forgery that allows authenticated users to redirect model requests to attacker-controlled endpoints, exfiltrating Google Cloud Vertex credentials and private signing keys. Organizations using AI Gateway features risk unauthorized access to AI infrastructure, potential lateral movement to GCP environments, and model tampering.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Gitlab Ai Gateway
View allServer-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exf
Remote command execution on the GitLab AI Gateway is achievable by an authenticated user who has been granted Duo Agent
Exploit-DB