CVE-2025-2867: GitLab Duo Information Disclosure Flaw

CVE-2025-2867 Overview

CVE-2025-2867 is an information disclosure vulnerability in GitLab Duo with Amazon Q, the AI-assisted development integration within GitLab. The flaw affects GitLab versions 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1 in both Community and Enterprise editions. An authenticated attacker can craft a malicious issue that manipulates AI-assisted development features to expose sensitive project data to unauthorized users. The vulnerability is tracked under [CWE-94] (Improper Control of Generation of Code) and stems from insufficient handling of untrusted content processed by the AI assistant.

Critical Impact
A specifically crafted issue can coerce GitLab Duo with Amazon Q into leaking confidential project information to users who lack authorization to view it.

Affected Products

GitLab Community Edition 17.8 before 17.8.6
GitLab Enterprise Edition 17.9 before 17.9.3
GitLab Community and Enterprise Edition 17.10 before 17.10.1

Discovery Timeline

2025-03-27 - CVE-2025-2867 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2867

Vulnerability Analysis

The vulnerability resides in the GitLab Duo with Amazon Q integration, which augments the developer workflow with AI-assisted code generation, issue triage, and merge request summarization. An attacker with low-privilege authenticated access can create an issue whose contents are structured to influence how the AI assistant interprets prompts. When another user or automated workflow invokes the AI features on that issue, the assistant processes the attacker-supplied text as part of its instruction context. This allows the attacker to redirect the assistant's behavior and cause it to return project data the requesting user was authorized to see, but the attacker was not. The flaw enables cross-user data exposure without any interaction beyond issue creation.

Root Cause

The root cause is improper separation between untrusted user content and trusted instructions supplied to the AI backend, a class of weakness classified under [CWE-94]. The AI pipeline treats issue text as authoritative input when generating responses, enabling prompt manipulation. Because output can be surfaced to unauthorized recipients, the confidentiality boundary between GitLab projects and users is broken.

Attack Vector

Exploitation requires network access to a GitLab instance and a low-privilege authenticated account. The attacker submits a crafted issue into a project where GitLab Duo with Amazon Q is enabled. When a privileged user later interacts with the AI features on that issue, the assistant follows attacker-supplied directives and discloses sensitive data. No user interaction from the victim is required beyond triggering the AI workflow.

No public proof-of-concept exploit is available for this vulnerability. Technical details are documented in the GitLab Issue #512509.

Detection Methods for CVE-2025-2867

Indicators of Compromise

Issues containing unusually structured markdown, hidden instruction blocks, or content resembling prompt directives targeting AI assistants.
Unexpected GitLab Duo responses that reference project data unrelated to the current issue or merge request.
Audit log entries showing AI feature invocations followed by data access anomalies on unrelated confidential resources.

Detection Strategies

Review GitLab audit logs for AI-assisted feature usage correlated with newly created issues from low-privilege accounts.
Inspect issue content for embedded prompt injection patterns such as directives instructing the assistant to disclose repository contents.
Correlate access to sensitive files or snippets with AI feature invocations occurring shortly beforehand.

Monitoring Recommendations

Enable and centralize GitLab application and audit logs for the projects that have GitLab Duo with Amazon Q enabled.
Monitor for AI response volume anomalies, particularly responses that exceed expected content size or reference unrelated projects.
Track issue creation patterns from newly created or dormant accounts that immediately trigger AI workflows.

How to Mitigate CVE-2025-2867

Immediate Actions Required

Upgrade GitLab to version 17.8.6, 17.9.3, or 17.10.1 or later, matching your deployed branch.
Audit issues created within affected projects since the deployment of GitLab Duo with Amazon Q for suspicious prompt content.
Restrict issue creation privileges in projects handling sensitive intellectual property until patching is complete.

Patch Information

GitLab has released fixed versions 17.8.6, 17.9.3, and 17.10.1 that address CVE-2025-2867. Administrators of self-managed GitLab instances should apply the patch corresponding to their release branch. GitLab.com SaaS tenants receive the fix automatically. Refer to the GitLab Issue #512509 for advisory context.

Workarounds

Disable the GitLab Duo with Amazon Q integration for projects containing confidential data until the upgrade is applied.
Limit AI-assisted feature access to trusted user roles by tightening project membership and permission scopes.
Enforce code and content review on issues before AI features are invoked in sensitive repositories.

bash

# Verify installed GitLab version and confirm patched release
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Example: upgrade Omnibus GitLab to a patched release (Debian/Ubuntu)
sudo apt-get update && sudo apt-get install gitlab-ee=17.10.1-ee.0

# Optional: disable GitLab Duo features project-wide via API until patched
curl --request PUT --header "PRIVATE-TOKEN: <token>" \
  "https://gitlab.example.com/api/v4/projects/<id>" \
  --data "duo_features_enabled=false"