Key takeaways
- (CVSS 9.9) allows authenticated users with Duo Agent Platform access to escape the prompt template sandbox and execute arbitrary commands.
- The vulnerability exclusively impacts self-hosted AI Gateway instances; GitLab.com and GitLab Dedicated are already patched and require no action.
- Remediated container versions are 19.2.4, 19.3.2, and 19.4.1; no interim workaround is available.
- Compromised gateways expose sensitive JWT signing keys, model provider connections, and internal network channels to the primary GitLab instance.
- Under GitLab’s standard maintenance policy, legacy versions from 18.1.6 through 19.1 receive no backported patch, requiring upgrades to supported release lines.
GitLab has issued emergency security updates to address a critical vulnerability in its AI Gateway tracked as CVE-2026-90970, which carries a maximum-severity CVSS score of 9.9. The flaw allows an authenticated user with access to the Duo Agent Platform to escape prompt template sandboxing and execute arbitrary commands on the underlying server. Only self-managed organizations that deploy their own self-hosted AI Gateway instances are exposed and must take immediate action. Managed deployments on GitLab.com, GitLab Dedicated, and self-managed instances pointing to GitLab-hosted gateways have already been patched by the vendor. GitLab released fixed gateway versions 19.2.4, 19.3.2, and 19.4.1, warning that no interim workarounds exist.
The disclosure, published on October 2, 2026, highlights the delicate operational boundaries required when organizations bring generative AI infrastructure inside private perimeters. Organizations choose self-hosted AI Gateways primarily to ensure that prompt queries and model telemetry remain strictly within their network boundary. However, hosting the AI integration plane locally transfers the complete operational burden of hardening, token isolation, and rapid patch deployment onto internal platform engineering and security teams.
Template injection enables sandbox escape in custom flows
The root of CVE-2026-90970 lies in how the AI Gateway evaluates prompt templates within custom flows. Custom flows on the Duo Agent Platform are designed to automate multi-step engineering tasks, allowing users to orchestrate autonomous development routines. Under specific execution conditions, an authenticated user configured with Duo Agent Platform access could craft a malicious flow definition that escapes the prompt template sandbox.
The vulnerability has been assigned the Common Weakness Enumeration identifier CWE-1336, denoting improper neutralization of special elements used in a template engine. Once the sandbox boundaries are bypassed, an attacker can invoke system-level commands with the privileges of the executing AI Gateway process. GitLab credited security researcher invisiblemeerkat via HackerOne for identifying and reporting the weakness.
This incident marks the second major template engine vulnerability uncovered in the gateway component this year. In February 2026, GitLab resolved CVE-2026-1868, another CVSS 9.9 vulnerability rooted in CWE-1336 that permitted code execution and denial of service via crafted flow definitions in the Duo Workflow Service. Similar sandbox boundaries have challenged other enterprise platforms; recently, Meta patched a severe flaw in its Muse AI assistant, underscoring systemic industry friction when blending dynamic prompt templates with backend command execution environments.
Infrastructure blast radius and sensitive credential exposure
The potential blast radius of an AI Gateway compromise is substantial due to the sensitive architectural role the component occupies. In a standard enterprise deployment, the self-hosted AI Gateway serves as the centralized communications broker between local GitLab instances and upstream large language model providers, whether hosted on private inference servers or reached through third-party APIs.
To perform its routing and authentication functions, a self-hosted gateway maintains sensitive configuration artifacts, including JSON Web Token (JWT) signing keys. GitLab’s deployment architecture mandates treating these JWT keys as high-value credentials because an attacker who obtains them could forge tokens, intercept inference traffic, or attempt lateral movement into connected repositories. Furthermore, because the gateway maintains bidirectional communication channels with the core GitLab server, command execution on the gateway offers an adversary a foothold directly adjacent to continuous integration pipelines and source code repositories.
According to an assessment added by the Cybersecurity and Infrastructure Security Agency (CISA) on October 2, there is currently no evidence of active in-the-wild exploitation or public proof-of-concept exploit code. However, GitLab’s security advisory does not provide indicators of compromise or forensic procedures to verify whether an unpatched gateway was targeted prior to remediation, placing the burden on enterprise administrators to examine container execution logs manually.
Affected versions and container upgrade path
The vulnerability impacts all AI Gateway versions from 18.1.6 up through unsupported releases of the 19.x series. Because the gateway is deployed independently of the core GitLab application as a containerized microservice, administrators must update the gateway container directly rather than relying on standard GitLab package upgrades.
| Gateway Series | Affected Version Range | First Remediated Release | Support Status |
|---|---|---|---|
| 19.4 | 19.4.0 | 19.4.1 | Supported; immediate upgrade required |
| 19.3 | 19.3.0 to 19.3.1 | 19.3.2 | Supported; immediate upgrade required |
| 19.2 | 18.1.6 to 19.2.3 | 19.2.4 | Supported; immediate upgrade required |
| 18.1.6 to 19.1 | All releases in range | None listed | Excluded under standard three-minor-version maintenance policy |
Because GitLab’s official maintenance policy only commits to backporting security fixes to the current and previous two minor releases (currently 19.4, 19.3, and 19.2), legacy deployments running AI Gateway 19.1 or older have received no security patch. IT directors and systems engineers managing those legacy environments must upgrade both their gateway and paired GitLab server to a supported 19.x release to achieve a protected posture.
Remediating an existing self-hosted AI Gateway involves updating the dedicated container image. According to GitLab’s AI Gateway deployment documentation, administrators should follow a structured redeployment process:
- Verify the current running gateway image tag and confirm whether the environment is managed via Docker standalone or Helm chart.
- For Docker-managed servers, stop and remove the active container instance using standard container runtime commands.
- Pull the patched container image matching your GitLab release track, such as
self-hosted-v19.4.1-ee. - Relaunch the container with existing persistent environment variables and secure JWT credential volumes intact.
- For Helm-based Kubernetes deployments, update the image tag property in the values configuration and trigger a rolling release rollout.
What happens next
Platform engineering and security operations teams must treat the remediation of self-hosted AI Gateways as an immediate priority. With CISA monitoring the vulnerability and CVSS scoring set at 9.9, the window between patch disclosure and the development of weaponized exploit chains is expected to be short.
Beyond deploying the container updates, enterprise security leaders should audit user access permissions across the Duo Agent Platform. Since exploitation requires authenticated access, restricting agent flow creation privileges to trusted developers reduces operational exposure. Teams should also inspect host process trees and container egress logs for unexpected outbound connections initiated from gateway pods.
In the longer term, the recurring emergence of template injection flaws in AI orchestration services highlights the need for defense-in-depth isolation. Platform architects should consider running AI gateway containers in rootless runtime environments with read-only root filesystems and minimal network egress, ensuring that even if a template sandbox escape occurs, the blast radius remains strictly contained.
Sources
- GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
- GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1
- CVE-2026-90970
- GitLab Duo Self-Hosted
- Install GitLab AI Gateway – Upgrade the AI Gateway Docker Image
- GitLab AI Gateway Critical Patch Release: 18.6.2, 18.7.1, and 18.8.1
- GitLab Maintenance Policy – Maintained Versions
