Intel

CVE-2026-75871

gitlab: Server-Side Request Forgery (SSRF) (CVE-2026-75871)

criticalEPSS 0.2%

Description

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, resulting in disclosure of Google Cloud Vertex cloud service credentials and private signing keys.

Source: NVDCVELISTV5

Metrics

Severity
critical
Priority score
76.36
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
9.6
Source: nvd-v3
CVSS v3
8.2
CVSS v4
—
EPSS percentile
9.0 %
Low — this CVE sits in the lower 10% of all CVEs scored today.
EPSS score
0.2 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-27 16:33 UTC
CWE
CWE-918

Weakness classes (CWE)

  • CWE-918Base

    Server-Side Request Forgery (SSRF)

    The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-09-01 20:32 UTC· nvd@nist.gov
    • CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
    • CPE Configuration: OR *cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* versions from (including) 18.10.0 up to (excluding) 19.0.12 *cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* versions from (including) 19.1.0 up to (excluding) 19.1.7 *cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* versions from (including) 19.2.0 up to (excluding) 19.2.2
    • Reference Type: GitLab Inc.: https://gitlab.com/gitlab-org/gitlab/-/work_items/616990 Types: Broken Link
    • Reference Type: GitLab Inc.: https://hackerone.com/reports/3945100 Types: Broken Link
  2. CVE Modified2026-08-27 20:18 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-75871","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalIm…

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • gitlab

    gitlab18.10.0 – 19.0.12

  • gitlab

    gitlab19.1.0 – 19.1.7

  • gitlab

    gitlab19.2.0 – 19.2.2

References & sources

IDCVE-2026-75871