Description

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an externally-controlled endpoint via crafted model metadata, resulting in the disclosure of Google Vertex AI or AWS Bedrock cloud service credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-27T17:17:43.170Z",
  "pubdate": "2026-08-27T17:17:43.170Z",
  "executiveSummary": "A server-side request forgery (SSRF) vulnerability exists within the GitLab AI Gateway component, allowing authenticated users with Duo Agent Platform access to manipulate outbound model requests. By injecting crafted model metadata, an attacker can influence the destination of API calls, effectively redirecting traffic to external, attacker-controlled endpoints.\nThis vulnerability specifically impacts the integrity of model-to-provider communication protocols. Successful exploitation results in the unauthorized disclosure of sensitive cloud provider credentials, specifically those associated with Google Vertex AI or AWS Bedrock services. This exposure presents a critical risk, as leaked credentials could be leveraged to gain unauthorized access to an organization's cloud infrastructure or consume significant compute resources at the victim's expense.\nThe vulnerability affects GitLab AI Gateway versions 18.9.0 through 19.0.12, 19.1 through 19.1.7, and 19.2 through 19.2.2. Exploitation requires the attacker to possess authenticated access to the Duo Agent Platform. Given the nature of the flaw, it facilitates the exfiltration of high-privilege service account tokens or API keys, potentially leading to persistent cloud environment compromise if not remediated immediately through the provided vendor updates.",
  "technicalDetails": "The vulnerability originates from improper input validation within the GitLab AI Gateway's request handler, specifically during the processing of model metadata. The AI Gateway acts as a proxy/intermediary between GitLab components and external generative AI providers (Google Vertex AI and AWS Bedrock).\nRoot Cause Analysis: The component fails to sufficiently sanitize user-supplied metadata headers or body parameters that define the target endpoint for downstream AI service requests. Because the gateway performs server-side requests based on these metadata definitions, it is susceptible to manipulation.\nAttack Flow: 1. The attacker, possessing authenticated access to the Duo Agent Platform, initiates a model request. 2. During the request formulation, the attacker injects malicious, crafted metadata into the request payload. 3. The GitLab AI Gateway, failing to validate this metadata against a strict allowlist of destination endpoints, parses the attacker-controlled URI/target. 4. The Gateway subsequently proxies the request to the attacker-controlled endpoint. 5. As part of the standard authentication handshake or header propagation, the Gateway inadvertently includes the active cloud service provider credentials (Google Vertex AI or AWS Bedrock) in the request intended for the malicious server. 6. The attacker's server receives the request and extracts the sensitive headers, successfully capturing the cloud service credentials.\nAuthentication and Privileges: Exploitation requires the actor to have active, authenticated access to the Duo Agent Platform. This is not a pre-authentication vulnerability; however, it represents a significant elevation of impact for any compromised or malicious user within that environment.\nPayload Behavior: The malicious payload typically involves overriding the destination host header or model configuration parameters within the gateway's request logic. By forcing the gateway to authenticate via its stored provider keys against an external, malicious listener, the attacker bypasses standard request boundaries.\nPost-Exploitation: The impact is the compromise of cloud identity and access management (IAM) tokens. With these credentials, an attacker could potentially access underlying cloud services, manipulate AI model data, or gain further persistence within the target's cloud provider tenancy. Because the credentials are valid for the configured services, they represent a high-value target for lateral movement within cloud-native architectures."
}