GitLab Patches Critical 9.9 AI Gateway Flaw Enabling Command Execution

GitLab has released a fix for a critical flaw in its AI Gateway — the service that links a GitLab instance to AI models. Under certain conditions, a logged-in user with Duo Agent Platform access could run commands directly on the gateway.

The flaw is tracked as CVE-2026-90970 and was disclosed on October 2. It carries a CVSS score of 9.9 out of 10. It is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1.

Who needs to act

Only organizations that run the AI Gateway in their own infrastructure need to update urgently. GitLab offers self-hosting for those who want request and response data to stay inside their own environment. Customers on GitLab.com, GitLab Dedicated, and self-managed instances that rely on a GitLab-hosted gateway need do nothing — the company has already fixed those. GitLab notified owners of self-hosted gateways before the advisory went public.

The gateway ships as its own Docker image or Helm chart and updates on its own: for Docker you stop and remove the running container, then pull and run the new image tag (for example self-hosted-v19.4.1-ee). No workaround is listed for gateways that cannot be updated yet, and there is no way to check whether a gateway was attacked before it was patched.

No fix is listed below 19.2.4, so every release from 18.1.6 through the 19.1 line stays in the affected range. GitLab's maintenance policy as of October 2 lists exactly those three lines — 19.4, 19.3, and 19.2 — as the ones receiving security fixes.

What is known about the flaw

According to the advisory's title, the bug sits in the prompt template of a custom flow — an AI-powered workflow that users build on the Duo Agent Platform to automate multi-step tasks. Using a specially crafted flow configuration, GitLab says, an attacker could "escape the prompt template sandbox" and achieve arbitrary command execution on the gateway. The advisory does not spell out the conditions required, nor name a role beyond Duo Agent Platform access.

A self-hosted gateway has plenty to protect: it holds the signing keys for JWTs, which GitLab treats as sensitive credentials, and it connects both to the GitLab instance and to the organization's AI model providers.

The advisory does not say whether the flaw has been exploited. On October 2, CISA added an assessment to the CVE record marking exploitation as "none." The flaw was reported by HackerOne user invisiblemeerkat.

It is the second find of its kind this year: in February GitLab patched CVE-2026-1868 — also rated 9.9, also reachable through a crafted flow and leading to denial of service or code execution on the gateway. Both bugs are template-engine weaknesses of the same class (CWE-1336), though the new advisory makes no mention of the earlier one.

Source: The Hacker News