CVE-2026-19889 in AI Gateway
Summary
by MITRE • 08/27/2026
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an externally-controlled endpoint via crafted model metadata, resulting in the disclosure of Google Vertex AI or AWS Bedrock cloud service credentials.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within GitLab's AI Gateway component represents a significant security flaw affecting multiple versions across recent release branches, specifically 18.9.0 through 19.0.12, 19.1 through 19.1.7, and 19.2 through 19.2.2. This issue stems from an improper validation of model metadata inputs provided by authenticated users who possess access to the Duo Agent Platform. The core technical flaw lies in the system's failure to strictly enforce allowed endpoints or sanitize input data when processing requests for AI models, allowing attackers to manipulate the destination address for these requests. By crafting specific model metadata fields, a malicious actor can redirect outbound API calls intended for legitimate cloud-based large language model providers such as Google Vertex AI or AWS Bedrock toward an endpoint controlled by the attacker. This mechanism effectively bypasses internal security controls designed to restrict communication with approved third-party services, creating a pathway for data exfiltration and potential abuse of organizational credentials stored within the GitLab environment.
From a technical perspective, this vulnerability is classified as an Unrestricted Redirect or Forward in web applications, which aligns closely with CWE-601: URL Redirection to Untrusted Site (Open Redirect). The exploitation vector relies on the application's trust in user-supplied metadata without sufficient verification against a whitelist of permitted domains. When the AI Gateway processes these requests, it fails to validate that the target host matches expected cloud provider endpoints like vertexai.googleapis.com or bedrock-runtime.us-east-1.amazonaws.com. Consequently, an authenticated attacker can construct payloads where the model configuration points to their own server. This allows them to intercept traffic destined for sensitive machine learning services, potentially capturing authentication tokens, API keys, and other secrets that are transmitted during normal operation of AI agents integrated with GitLab CI/CD pipelines or development workflows.
The operational impact of this vulnerability is severe due to the high privilege level required for exploitation combined with the sensitivity of the data at risk. An attacker who has obtained valid credentials for an account with Duo Agent Platform access can leverage this flaw to exfiltrate cloud service credentials associated with Google Vertex AI and AWS Bedrock accounts linked to the GitLab instance. These credentials often possess broad permissions within their respective cloud environments, potentially allowing further lateral movement, unauthorized resource provisioning, or data theft from other systems connected via those API keys. Furthermore, by redirecting requests to a malicious endpoint, an attacker could also perform man-in-the-middle attacks to inject harmful prompts into AI models, leading to potential poisoning of generated code or responses if the system is configured to accept feedback loops from external sources. This compromises not only confidentiality but also integrity and availability of AI-driven development processes.
Mitigation strategies must prioritize immediate patching alongside robust access control reviews. Organizations running affected versions should upgrade GitLab to a version where this vulnerability has been remediated, ensuring that input validation logic correctly restricts model request redirections to authorized cloud providers. In addition to upgrading, administrators should enforce strict least-privilege principles for users with access to the Duo Agent Platform and AI Gateway components. Implementing network-level controls such as egress filtering can provide a critical layer of defense by blocking outbound connections to unauthorized IP addresses or domains that do not belong to recognized cloud service providers. Regular auditing of API key usage and monitoring for anomalous traffic patterns directed toward external endpoints will also aid in early detection of exploitation attempts, ensuring the integrity of AI-assisted development environments remains intact against such redirection attacks.