GitLab AI Gateway Flaw CVE-2026-90970: What to Patch
GitLab patched a CVSS 9.9 sandbox escape in its self-hosted AI Gateway. Affected versions, fixed versions, who is exposed, and what to check this week.
GitLab disclosed a critical flaw on 2 October 2026 in the AI Gateway that powers its Duo Agent Platform. Tracked as CVE-2026-90970 with a CVSS score of 9.9, it lets a logged-in user with platform access escape the prompt template sandbox and run commands on the gateway host. It only affects self-hosted gateways. Fixed versions are 19.2.4, 19.3.2 and 19.4.1.
Who is affected
According to The Hacker News, only organisations running their own AI Gateway are exposed. Customers on GitLab.com, GitLab Dedicated, or GitLab-hosted gateways are not affected and need to do nothing.
Affected and fixed versions
Gateway 18.1.6 up to, but not including, 19.2.4: upgrade to 19.2.4.
Gateway 19.3 up to, but not including, 19.3.2: upgrade to 19.3.2.
Gateway 19.4 up to, but not including, 19.4.1: upgrade to 19.4.1.
GitLab's own notice is in its patch release announcement. The reporter is credited as HackerOne user invisiblemeerkat. The Hacker News reports no known exploitation so far, and that GitLab lists no workaround for gateways that cannot update immediately.
How the bug works, in plain terms
The flaw sits in how the gateway handles the prompt template of custom flows. A custom flow is a multi-step automated workflow a user defines on the platform. If the template engine that fills in those prompts is not properly sandboxed, a crafted flow configuration can reach past the template and execute code on the server. The attacker needs a login with access to the Duo Agent Platform, so this is not an anonymous internet bug, but any account with that access becomes a route to the host.
What to check this week
Find out whether you run a self-hosted AI Gateway at all. Many teams do not know, because it can be set up once and forgotten.
Read the version, and upgrade to the fixed release for your line.
Review who holds Duo Agent Platform access. This is general hardening, not GitLab guidance: the fewer accounts that can define custom flows, the smaller the exposure while you patch.
After patching, look at the gateway host for unexpected processes or outbound connections, since the fix does not tell you whether someone used the flaw earlier.
The wider lesson
Prompt templates look like content, so teams review them like content. When a template engine runs on your server and its inputs come from users, it is code execution territory. If you run your own gateway or build something similar, the same questions apply: who can edit templates, what can a template reach, and what is the process running as. Our explainers on what an AI gateway is and how to sandbox an AI agent cover the basics, and the Ray framework vulnerability is a recent example of AI infrastructure landing on a known-exploited list. For the full risk map, start with the AI risks guide.
Also this week, CVE-2026-61500 in Rejetto HFS showed how quickly attackers move once a flaw is public.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
