CVE-2026-19889: Server-Side Request Forgery (SSRF) in GitLab AI Gateway
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an externally-controlled endpoint via crafted model metadata, resulting in the disclosure of Google Vertex AI or AWS Bedrock cloud service credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab AI Gatewayto a version that resolves this vulnerability.Fixed in 19.0.12 - Upgrade
Upgrade
GitLab AI Gatewayto a version that resolves this vulnerability.Fixed in 19.1.7 - Upgrade
Upgrade
GitLab AI Gatewayto a version that resolves this vulnerability.Fixed in 19.2.2 - Upgrade
Upgrade
GitLab AI Gatewayto a version that resolves this vulnerability.Fixed in 19.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated user who has access to the Duo Agent Platform. The attacker must craft model metadata that redirects model requests to an externally controlled endpoint.
Which deployments are affected?
Affected versions are AI Gateway 18.9.0 through 19.0.12, 19.1 through 19.1.7, and 19.2 through 19.2.2. The provided information does not state whether every default AI Gateway configuration exposes Duo Agent Platform access.
What could be exposed if exploitation succeeds?
A successful attack could disclose cloud service credentials used for Google Vertex AI or AWS Bedrock. The issue is described as allowing request redirection through crafted model metadata.