GitLab has released critical security updates for its AI Gateway to address CVE-2026-90970, a vulnerability that could allow authenticated users to execute arbitrary commands on vulnerable self-hosted deployments.
The flaw carries a CVSS score of 9.9 out of 10 and affects GitLab AI Gateway versions beginning with 18.1.6 across several release branches.
GitLab issued patched AI Gateway releases 19.2.4, 19.3.2, and 19.4.1, urging all customers operating a GitLab Self-Hosted AI Gateway to upgrade immediately.
GitLab Patches Critical AI Gateway Flaw
Tracked as CVE-2026-90970, the issue stems from improper neutralization in the custom-flow prompt template mechanism used by GitLab AI Gateway.
Under certain conditions, an authenticated user who has access to the Duo Agent Platform could submit a specially crafted flow configuration and escape the prompt-template sandbox.
A successful sandbox escape could result in arbitrary command execution on the AI Gateway host or container. This could expose the gateway environment to unauthorized actions.
GitLab rated the issue as critical using the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting network reachability, low attack complexity, required low privileges, no user interaction.
The vulnerability affects GitLab AI Gateway versions from 18.1.6 up to, but excluding, 19.2.4. It also affects versions in the 19.3 branch before 19.3.2 and releases in the 19.4 branch before 19.4.1.
The advisory applies specifically to organizations that operate their own AI Gateway infrastructure.
GitLab Self-Managed customers using a Self-Hosted AI Gateway should treat the update as urgent, particularly where users have been granted Duo Agent Platform access and can interact with custom flow configurations.
GitLab.com, GitLab Dedicated, and GitLab Self-Managed instances that rely on a GitLab-hosted AI Gateway do not require customer action. GitLab said it has already deployed the remediation across its hosted AI Gateway environment.
The distinction is important because the AI Gateway is a separate component from the core GitLab application.
Administrators should verify the deployed AI Gateway image or Helm configuration rather than assuming that an upgrade to the main GitLab CE or EE instance alone remediates the exposure.
Organizations running an affected deployment should update their GitLab AI Gateway to version 19.2.4, 19.3.2, or 19.4.1, depending on the supported release branch they operate.
GitLab has not listed a workaround for customers unable to apply the updates, making a direct upgrade the primary mitigation.
Security teams should also review Duo Agent Platform permissions, restrict access to custom flow configuration capabilities where possible, and examine recent configuration changes for unexpected or unapproved flow templates.
While exploitation requires access to the Duo Agent Platform, the vulnerability’s low complexity and potential for command execution make prompt patching essential to reduce exposure.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
