CVE-2026-19889: CWE-918: Server-Side Request Forgery (SSRF) in GitLab GitLab AI Gateway

CVE-2026-19889 is a CWE-918 SSRF vulnerability in the GitLab AI Gateway component. It affects all versions from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2. An authenticated user with Duo Agent Platform access can craft model metadata to redirect AI model requests to external endpoints controlled by an attacker. This redirection can lead to the disclosure of sensitive cloud service credentials for Google Vertex AI or AWS Bedrock. The vulnerability impacts confidentiality with a CVSS 3.1 score of 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N). The affected product is a cloud service, and GitLab manages remediation on their side.

The vulnerability allows an authenticated user with specific platform access to redirect internal AI model requests to external endpoints, resulting in the disclosure of sensitive cloud service credentials. This compromises confidentiality and integrity of the affected cloud services. There is no known exploitation in the wild at this time.

GitLab manages remediation for this cloud-hosted service. A patch is available and has been applied by the vendor. Users should verify with GitLab's official advisory for confirmation of remediation status and ensure their GitLab AI Gateway service is updated accordingly. No additional action is required beyond applying the vendor-managed fix.