GitLab Patches Critical Self-Hosted AI Gateway Flaw CVE-2026-90970, a CVSS 9.9 Prompt-Template Sandbox Escape
GitLab fixed CVE-2026-90970, a CVSS 9.9 flaw that let authenticated Duo Agent Platform users escape a prompt template sandbox on self-hosted AI Gateways.
Overview
GitLab has released versions 19.2.4, 19.3.2, and 19.4.1 of its AI Gateway to fix a critical vulnerability, tracked as CVE-2026-90970, according to GitLab’s patch release notice. The notice says the fix is for the GitLab Self-Hosted AI Gateway. BleepingComputer reported the disclosure on October 2, 2026.
What We Know
- The flaw. GitLab’s notice lists the issue as “Improper Neutralization issue in custom flow prompt template impacts AI Gateway” with a severity of Critical. GitLab says it “could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway,” according to the release notice.
- Severity. The notice assigns a CVSS score of 9.9, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
- Affected versions. Per the release notice, the impacted range is all AI Gateway versions from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1.
- Who must act. GitLab says it strongly recommends that all GitLab Self-Managed customers with GitLab Self-Hosted AI Gateway installations update to one of the patched versions immediately. It also says a fix has already been deployed for GitLab-hosted AI Gateways, and that customers using GitLab.com, GitLab Dedicated, and Self-Managed instances using a GitLab-hosted AI Gateway are protected and do not need to take action.
- Pre-disclosure outreach. GitLab states it conducted targeted outreach to Self-Hosted AI Gateway customers prior to the release post.
- Credit. GitLab thanks a researcher identified as invisiblemeerkat for responsibly disclosing the issue.
An Earlier Gateway Fix With a Similar Profile
This is not the first critical fix for the component. GitLab’s earlier notice says that on February 6, 2026, it released versions 18.6.2, 18.7.1, and 18.8.1 of the AI Gateway. That release fixed CVE-2026-1868, which GitLab describes as insecure template expansion of user-supplied data in the Duo Workflow Service component via crafted Duo Agent Platform Flow definitions. GitLab says that flaw required authenticated access to the GitLab instance and could be used to cause Denial of Service or gain code execution on the Gateway.
The February notice gives the same CVSS 9.9 score and the same vector string as the new one, and it says that vulnerability was discovered internally by GitLab team member Joern Schneeweisz. Both flaws involve flow definitions or flow configuration in the Duo Agent Platform and the same authenticated-access precondition. The notices do not state whether the two issues share a root cause or whether the new fix is related to the February one.
The Machine Herald previously reported on a critical command-execution flaw in a different product, the Bifrost AI gateway.
What We Don’t Know
- GitLab’s notice does not say whether the flaw has been exploited in the wild, and the sources reviewed here do not report exploitation.
- The notice does not describe the technical mechanism beyond the quoted description, and it does not say whether a public proof of concept exists.
- The notice does not say how many self-hosted installations were running affected versions.
- The notice itself carries no publication date; the October 2, 2026 date above is that of BleepingComputer’s report.
Analysis
For administrators, GitLab’s guidance is the actionable part. Self-hosted AI Gateway operators should check their version against the affected ranges listed above and upgrade to 19.2.4, 19.3.2, or 19.4.1, while those using a GitLab-hosted gateway need to do nothing, according to GitLab.