GitLab AI Gateway Model Endpoint Redirection Credential Disclosure
First seen Aug 27, 2026 · Updated Aug 27, 2026 · CVSS 8.2
A vulnerability in GitLab's AI Gateway allowed an authenticated user with access to the Duo Agent Platform to redirect model inference requests to an attacker-controlled endpoint by crafting model metadata. This could leak sensitive Google Vertex AI or AWS Bedrock cloud service credentials to the attacker's server. GitLab has already remediated the issue in patched versions.
Technical Analysis
The AI Gateway component trusts model metadata supplied by authenticated Duo Agent Platform users when determining the destination endpoint for LLM inference calls. By crafting malicious metadata, an attacker can cause the Gateway to route the model request to an external, attacker-controlled server instead of the legitimate Vertex AI or Bedrock endpoint. Because the Gateway attaches cloud service credentials (e.g., bearer tokens or signed requests) to these outbound calls, the redirected request exposes valid cloud credentials to the attacker-controlled endpoint. This crosses a trust boundary between the agent orchestration layer (Duo Agent Platform) and the underlying cloud-hosted model backends, effectively turning a tool/config parameter into an SSRF-style credential exfiltration vector. The attacker gains reusable cloud credentials that could be leveraged for further access to Vertex AI or Bedrock resources.
Affected Systems
GitLab Duo Agent Platform, GitLab AI Gateway
Detection Signatures
- Outbound AI Gateway requests to non-allowlisted or unexpected external domains
- Model metadata fields containing unexpected endpoint/URL overrides
- Anomalous outbound traffic from AI Gateway service correlated with Duo Agent Platform user activity
- Unusual or unauthorized use of Vertex AI/Bedrock credentials from IPs outside expected cloud provider ranges
- Audit log entries showing model configuration changes by low-privilege authenticated users
Remediation Steps
- 1
Upgrade GitLab AI Gateway
Update to GitLab AI Gateway versions 19.0.12, 19.1.7, 19.2.2, or later that contain the fix.
- 2
Restrict Duo Agent Platform Access
Limit which users/roles can configure or supply model metadata to trusted, need-to-know personnel.
- 3
Rotate Cloud Credentials
Rotate Vertex AI and AWS Bedrock service credentials used by the AI Gateway in case of prior exposure.
- 4
Enforce Endpoint Allowlisting
Implement strict server-side validation/allowlisting of model endpoint destinations independent of user-supplied metadata.
- 5
Monitor Outbound Traffic
Deploy egress monitoring/alerting for AI Gateway traffic to detect requests to unexpected external domains.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.