GitLab AI Gateway SSRF via Host Header Override Leaking Vertex AI Credentials

Technical Analysis

The AI Gateway component, which brokers requests between GitLab's Duo Agent Platform and backend LLM providers (Google Cloud Vertex AI), accepted inline flow configuration input that could override the outbound HTTP Host header used when routing model requests. An authenticated user with Duo Agent Platform access could craft this configuration to redirect the request to an externally-controlled endpoint while credentials and signing material intended for the legitimate Vertex AI endpoint were still attached to the request. This crosses a trust boundary between the agent orchestration layer (which should only route to allow-listed model backends) and arbitrary external hosts, effectively turning a configuration parameter into an SSRF/credential-exfiltration primitive. The attacker gains disclosure of cloud service credentials and private signing keys, which could subsequently be used to impersonate the AI Gateway, forge signed requests, or pivot into the victim's GCP environment.

Affected Systems

GitLab Duo Agent Platform, GitLab AI Gateway

Detection Signatures

• Outbound AI Gateway requests with Host header values not matching allow-listed model endpoints (e.g., not *.googleapis.com for Vertex AI)
• Inline flow configuration payloads containing unexpected 'host', 'endpoint', or header-override fields
• Anomalous DNS resolution or outbound connections from AI Gateway service to non-Google Cloud IP ranges
• Authentication logs showing Duo Agent Platform users creating or modifying flow configs shortly before anomalous outbound traffic
• Unexpected inclusion of Authorization/service-account credential headers in requests to non-standard hosts

Remediation Steps

1. 1

   Upgrade GitLab AI Gateway

   Apply the vendor patch by upgrading to GitLab versions 19.0.12, 19.1.7, 19.2.2, or later that remediate CVE-2026-75871.

2. 2

   Enforce endpoint allow-listing

   Configure the AI Gateway to strictly validate and pin outbound Host headers and destination endpoints for model requests, rejecting any inline flow configuration that attempts to override them.

3. 3

   Rotate exposed credentials

   Rotate Google Cloud Vertex AI service account credentials and private signing keys used by the AI Gateway, assuming potential prior exposure.

4. 4

   Restrict Duo Agent Platform access

   Limit which authenticated users can create or modify inline flow configurations, applying least-privilege and audit logging for this capability.

5. 5

   Deploy egress monitoring

   Implement network egress filtering and monitoring on the AI Gateway host to detect and block connections to unexpected external endpoints.