GitLab's Duo Agent Platform could redirect model requests to an attacker-controlled endpoint (CVSS 8.2).

CVE-2026-19889 and CVE-2026-75871, published August 27, let an authenticated user with Duo access redirect outbound model requests externally, affecting AI Gateway 18.9.0/18.10 through 19.0.12, 19.1 to 19.1.7 and 19.2 to 19.2.2 (NVD). Redirecting the model endpoint sends every prompt and its attached repo context to the attacker, and returns every response as trusted. Second GitLab agent-surface disclosure in two days.