Gitlab Ai Gateway
Monthly
Remote command execution on the GitLab AI Gateway is achievable by an authenticated user who has been granted Duo Agent Platform access, by supplying a specially crafted flow configuration whose prompt template escapes the intended sandbox (CVE-2026-90970). The flaw is a server-side template injection (CWE-1336) rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a single low-privileged authenticated account yields high confidentiality, integrity, and availability impact that extends beyond the vulnerable component's own security scope. Affected deployments are AI Gateway versions 18.1.6 up to but not including 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1; GitLab has remediated the issue and no public exploit identified at time of analysis, though the requirement for Duo Agent Platform to be enabled and for the attacker to hold a legitimate authenticated account with access to it materially narrows the exposed population.
Server-side request forgery in the GitLab AI Gateway (Duo Agent Platform) lets an authenticated user redirect outbound model requests to an attacker-controlled endpoint by supplying a crafted inline flow configuration that overrides the HTTP Host header, exfiltrating Google Cloud Vertex service credentials and private signing keys. It affects AI Gateway 18.10 through 19.0.11, 19.1 through 19.1.6, and 19.2 through 19.2.1. Publicly available exploit code exists (HackerOne #3945100); EPSS is low at 0.19% and it is not in CISA KEV.
Server-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exfiltrate Google Vertex AI or AWS Bedrock cloud service credentials by injecting a malicious endpoint into crafted model metadata, causing the gateway to proxy requests - including cloud credentials - to an attacker-controlled server. All AI Gateway releases from 18.9.0 through 19.2.2 are affected across three version branches; GitLab has confirmed remediation. A public exploit exists per the HackerOne reference, and the CVSS Scope Change metric (S:C) reflects that successful exploitation extends compromise to external cloud infrastructure beyond the GitLab instance itself.
Remote command execution on the GitLab AI Gateway is achievable by an authenticated user who has been granted Duo Agent Platform access, by supplying a specially crafted flow configuration whose prompt template escapes the intended sandbox (CVE-2026-90970). The flaw is a server-side template injection (CWE-1336) rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a single low-privileged authenticated account yields high confidentiality, integrity, and availability impact that extends beyond the vulnerable component's own security scope. Affected deployments are AI Gateway versions 18.1.6 up to but not including 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1; GitLab has remediated the issue and no public exploit identified at time of analysis, though the requirement for Duo Agent Platform to be enabled and for the attacker to hold a legitimate authenticated account with access to it materially narrows the exposed population.
Server-side request forgery in the GitLab AI Gateway (Duo Agent Platform) lets an authenticated user redirect outbound model requests to an attacker-controlled endpoint by supplying a crafted inline flow configuration that overrides the HTTP Host header, exfiltrating Google Cloud Vertex service credentials and private signing keys. It affects AI Gateway 18.10 through 19.0.11, 19.1 through 19.1.6, and 19.2 through 19.2.1. Publicly available exploit code exists (HackerOne #3945100); EPSS is low at 0.19% and it is not in CISA KEV.
Server-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exfiltrate Google Vertex AI or AWS Bedrock cloud service credentials by injecting a malicious endpoint into crafted model metadata, causing the gateway to proxy requests - including cloud credentials - to an attacker-controlled server. All AI Gateway releases from 18.9.0 through 19.2.2 are affected across three version branches; GitLab has confirmed remediation. A public exploit exists per the HackerOne reference, and the CVSS Scope Change metric (S:C) reflects that successful exploitation extends compromise to external cloud infrastructure beyond the GitLab instance itself.