Gitlab Ai Gateway
Monthly
Server-Side Request Forgery (SSRF) in GitLab's AI Gateway component allows an authenticated user with Duo Agent Platform access to redirect outbound model requests to an attacker-controlled endpoint by injecting a crafted inline flow configuration that overrides the HTTP Host header. Exploitation results in exfiltration of Google Cloud Vertex cloud service credentials and private signing keys held by the AI Gateway, enabling an adversary to subsequently authenticate to GCP services outside GitLab's control. No public exploitation (CISA KEV) has been confirmed, but a publicly available exploit exists via a disclosed HackerOne report, materially increasing real-world risk.
Server-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exfiltrate Google Vertex AI or AWS Bedrock cloud service credentials by injecting a malicious endpoint into crafted model metadata, causing the gateway to proxy requests - including cloud credentials - to an attacker-controlled server. All AI Gateway releases from 18.9.0 through 19.2.2 are affected across three version branches; GitLab has confirmed remediation. A public exploit exists per the HackerOne reference, and the CVSS Scope Change metric (S:C) reflects that successful exploitation extends compromise to external cloud infrastructure beyond the GitLab instance itself.
Server-Side Request Forgery (SSRF) in GitLab's AI Gateway component allows an authenticated user with Duo Agent Platform access to redirect outbound model requests to an attacker-controlled endpoint by injecting a crafted inline flow configuration that overrides the HTTP Host header. Exploitation results in exfiltration of Google Cloud Vertex cloud service credentials and private signing keys held by the AI Gateway, enabling an adversary to subsequently authenticate to GCP services outside GitLab's control. No public exploitation (CISA KEV) has been confirmed, but a publicly available exploit exists via a disclosed HackerOne report, materially increasing real-world risk.
Server-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exfiltrate Google Vertex AI or AWS Bedrock cloud service credentials by injecting a malicious endpoint into crafted model metadata, causing the gateway to proxy requests - including cloud credentials - to an attacker-controlled server. All AI Gateway releases from 18.9.0 through 19.2.2 are affected across three version branches; GitLab has confirmed remediation. A public exploit exists per the HackerOne reference, and the CVSS Scope Change metric (S:C) reflects that successful exploitation extends compromise to external cloud infrastructure beyond the GitLab instance itself.