CVE-2026-75871: Server-Side Request Forgery (SSRF) in GitLab AI Gateway
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, resulting in disclosure of Google Cloud Vertex cloud service credentials and private signing keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab AI Gatewayto a version that resolves this vulnerability.Fixed in 19.0.12 - Upgrade
Upgrade
GitLab AI Gatewayto a version that resolves this vulnerability.Fixed in 19.1.7 - Upgrade
Upgrade
GitLab AI Gatewayto a version that resolves this vulnerability.Fixed in 19.2.2 - Upgrade
Upgrade
GitLab AI Gatewayto a version that resolves this vulnerability.Fixed in 19.3.0
Event History
Frequently Asked Questions
Which deployments are exposed?
The issue affects GitLab AI Gateway versions 18.10 through 19.0.12, 19.1 through 19.1.7, and 19.2 through 19.2.2. Exploitation is limited to environments where a user has access to the Duo Agent Platform.
What level of access does an attacker need?
An attacker must be authenticated and have Duo Agent Platform access. They must also be able to use a crafted inline flow configuration to override the HTTP Host header for outbound model requests.
What could be exposed if exploitation succeeds?
Successful exploitation could disclose Google Cloud Vertex cloud service credentials and private signing keys. The provided data does not indicate an availability impact.