GitLab says a critical flaw in its AI Gateway service could let an attacker run commands on affected self-hosted systems. The bug, CVE-2026-90970, affects GitLab Self-Hosted AI Gateway used with GitLab Duo Self-Hosted and allows an authenticated user with basic privileges and Duo Agent Platform access to escape the prompt-template sandbox through a crafted flow configuration. GitLab fixed it in AI Gateway versions 19.2.4, 19.3.2, and 19.4.1; GitLab-hosted AI Gateway customers are already protected.
Why it matters: Organizations running their own GitLab AI Gateway could face server compromise from a low-privilege authenticated user, so this is an urgent update-now issue. Self-managed customers using Duo Self-Hosted should identify any self-hosted AI Gateway deployments and patch immediately.
info@thehackernews.com (The Hacker News)
2026.10.02
99% relevant
This article reports the same GitLab AI Gateway vulnerability and patch release, reinforcing that CVE-2026-90970 is a critical 9.9-severity command-execution issue affecting self-hosted deployments.
Sergiu Gatlan
2026.10.02
100% relevant
This article establishes a distinct new event: GitLab's disclosure and patching of CVE-2026-90970 in AI Gateway, which is separate from the previously tracked GitLab CE/EE CVE-2026-85706 file-read flaw.
← Back to all stories