A critical Server-Side Request Forgery vulnerability in the GitLab AI Gateway could allow authenticated users to exfiltrate sensitive cloud service credentials and private signing keys.

This vulnerability is a Server-Side Request Forgery (CWE-918) flaw. It allows an authenticated user with Duo Agent Platform access to manipulate inline flow configurations to override the HTTP Host header, forcing the gateway to send requests to attacker-controlled endpoints.

The exposure of Google Cloud Vertex credentials and private signing keys represents a high-impact security failure. With a CVSS score of 8.2, this vulnerability allows for the potential compromise of sensitive infrastructure, unauthorized access to cloud resources, and the bypass of organizational security controls. Such a breach could lead to significant data exfiltration and long-term reputational damage.

Immediate Action: Upgrade the GitLab AI Gateway component to version 19.0.12, 19.1.7, 19.2.2, 19.3.0, or any subsequent release provided by the vendor.

Proactive Monitoring: Review outbound network traffic logs from the AI Gateway for connections to unrecognized or external domains, and monitor Google Cloud audit logs for anomalous usage of Vertex AI credentials.

Compensating Controls: Implement strict egress filtering rules at the network level to restrict the AI Gateway from communicating with unauthorized external IP addresses or domains.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up on HackerOne.

Given the potential for total compromise of cloud service credentials, this vulnerability poses a substantial risk to the integrity of the environment. Organizations must prioritize the deployment of the vendor-provided patches. Until updates are applied, restrict access to the Duo Agent Platform to the minimum number of necessary users and implement robust egress controls to prevent data exfiltration.