GitLab patches critical AI Gateway flaw allowing command execution on self-hosted servers

GitLab AI Gateway faces critical security threat

GitLab disclosed a critical vulnerability on October 2 that exposes self-hosted AI Gateway instances to remote code execution attacks1

1

. The security flaw, tracked as CVE-2026-90970, carries a CVSS score 9.9 out of 10, marking it as one of the most severe vulnerabilities in GitLab's recent history2

2

. The GitLab AI Gateway serves as the connection layer between GitLab instances and AI models, providing access to AI-native GitLab Duo features for the platform's over 30 million registered users1

1

.

How the improper neutralization flaw works

The critical vulnerability stems from an improper neutralization weakness in the prompt template of custom flows created on the Duo Agent Platform2

2

. Authenticated users with Duo Agent Platform access could exploit this security flaw to escape the prompt template sandbox through a specially crafted flow configuration1

1

. Once the sandbox escape is achieved, attackers can execute arbitrary commands directly on the AI Gateway infrastructure2

2

. The vulnerability affects every gateway release from version 18.1.6 through the entire 19.1 line, leaving a significant number of self-hosted servers potentially exposed2

2

. HackerOne user invisiblemeerkat reported the flaw to GitLab2

2

.

Immediate action required for Self-Managed customers

GitLab released patched versions 19.2.4, 19.3.2, and 19.4.1 to address CVE-2026-90970 and strongly recommends that all Self-Managed customers with self-hosted AI Gateway installations update immediately1

1

. The company conducted targeted outreach to self-hosted servers customers before public disclosure to ensure rapid response1

1

. Organizations using GitLab.com, GitLab Dedicated, or self-managed instances that rely on GitLab-hosted AI Gateway are already protected and do not need to take action2

2

. The gateway is installed as its own Docker image or Helm chart, requiring administrators to stop running containers, pull new image tags, and restart with the updated version2

2

. No workaround exists for gateways that cannot be updated yet2

2

.

Pattern of high-severity vulnerabilities emerges

This marks the second time in 2026 that GitLab has patched a 9.9-rated flaw in its AI Gateway. In February, GitLab fixed CVE-2026-1868, another remote code execution vulnerability that allowed logged-in users to trigger denial of service or code execution through crafted flow definitions2

2

. Both flaws belong to the same class of template engine weaknesses, classified as CWE-13362

2

. Last month, GitLab also addressed CVE-2026-85706, a maximum severity path traversal vulnerability in GitLab Community Edition and Enterprise Edition that allows unauthenticated attackers to read sensitive data including credentials and secrets1

1

. CISA added CVE-2026-85706 to its list of actively exploited flaws just one day after GitLab's patch, giving federal agencies three days to secure their systems under Binding Operational Directive 26-041

1

. Since November 2021, CISA has tagged five GitLab vulnerabilities as actively exploited in the wild, including flaws used by ransomware gangs1

1

.

What organizations should monitor

As of October 2, CISA assessed CVE-2026-90970 exploitation status as "none," indicating no public proof of concept or active attacks have been observed2

2

. However, self-hosted AI Gateway instances hold sensitive signing keys for JSON Web Tokens that must be treated as critical credentials, and they maintain connections to both GitLab instances and AI model providers2

2

. GitLab's DevSecOps platform serves over 50% of Fortune 100 companies, including Nvidia, Lockheed Martin, T-Mobile, Goldman Sachs, Airbus, and UBS, making these vulnerabilities particularly concerning for enterprise security teams1

1

. Organizations should verify their AI Gateway versions, prioritize updates to self-hosted servers, and monitor for any suspicious activity that may indicate exploitation attempts before patches were applied.