{"data":{"id":"a91878b7-cb22-445e-bfa4-80cd88311a81","title":"CVE-2026-19889: GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from…","summary":"GitLab has remediated a vulnerability in the GitLab AI Gateway component, affecting all versions from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2. An authenticated user with Duo Agent Platform access could redirect model requests to an externally-controlled endpoint via crafted model metadata, which could have disclosed Google Vertex AI or AWS Bedrock cloud service credentials.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19889","publishedAt":"2026-08-27T17:17:43.170Z","cveId":"CVE-2026-19889","cweIds":["CWE-918"],"cvssScore":"8.2","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Google","Amazon"],"affectedVendorsRaw":["GitLab AI Gateway","GitLab Duo Agent Platform","Google Vertex AI","AWS Bedrock"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"GitLab AI Gateway model request redirection exposes cloud credentials","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00355,"epssCheckedAt":"2026-11-04T12:08:35.127Z","kevDateAdded":null,"advisoryAliases":["GHSA-vm6q-jfj7-8c34"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T18:09:01.575Z","patchAvailable":null,"disclosureDate":"2026-08-27T17:17:43.170Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}