Overview of CVE-2026-90970 and GitLab AI Gateway Risks
GitLab has issued an urgent advisory regarding a critical vulnerability, tracked as CVE-2026-90970, affecting its self-hosted AI Gateway installations. This flaw, rated with a CVSS score of 9.9 out of 10 by GitLab, allows a logged-in user with access to the Duo Agent Platform to execute arbitrary commands on the gateway server. The AI Gateway serves as the critical intermediary connecting a GitLab instance to various AI models, and its compromise could expose sensitive data and critical system functionalities.
While GitLab manages AI Gateways for its cloud customers, ensuring these instances are already patched, organizations that choose to host their own gateway deployments are directly impacted and must take immediate action. The primary motivation for self-hosting the AI Gateway is often to maintain AI request and response data within the organization’s own environment for compliance and security reasons. Therefore, a vulnerability like CVE-2026-90970 presents a significant risk to the integrity and confidentiality of these deployments.
As of the disclosure on October 2, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has assessed exploitation for this vulnerability as “none,” meaning there is no current evidence of in-the-wild attacks. However, the severity of arbitrary command execution combined with GitLab’s strong recommendation for immediate updates underscores the potential impact should attackers develop and deploy exploits for this flaw. Security professionals seeking GitLab AI Gateway command execution mitigation must prioritize patching.
Technical Details of the Prompt Template Escape
The vulnerability, classified as CWE-1336 (Improper Neutralization of Special Elements used in a Template Engine), resides within the prompt template mechanism of custom flows on the Duo Agent Platform. A logged-in user with Duo Agent Platform access could leverage this flaw by crafting a specially configured flow. This crafted configuration allows the user to “escape the prompt template sandbox,” effectively breaking out of the intended secure execution environment and achieving arbitrary command execution on the underlying AI Gateway server.
The specific conditions required for exploitation, beyond the need for Duo Agent Platform access and a logged-in session, are not fully detailed in the advisory. However, the ability to execute arbitrary commands on a server that handles sensitive AI request/response data and stores JSON Web Token (JWT) signing keys is a severe concern. Compromise of these JWT keys could lead to further unauthorized access within the GitLab ecosystem or to connected AI model providers.
Identifying and Patching Vulnerable GitLab AI Gateway Versions
The CVE-2026-90970 patch guidance specifies that the vulnerability affects all GitLab AI Gateway versions from 18.1.6 through the 19.1 line, as well as versions 19.2.0 through 19.2.3, 19.3.0 through 19.3.1, and 19.4.0. GitLab has released patched versions 19.2.4, 19.3.2, and 19.4.1 to address this critical issue. It is important to note that the AI Gateway is installed as a separate Docker image or Helm chart, meaning its update process is distinct from the main GitLab instance. Organizations must verify their current AI Gateway version independently.
Mitigation and Recommendations for Self-Hosted Deployments
For organizations running self-hosted GitLab AI Gateways, immediate action is paramount. There is no known workaround available for gateways that cannot be updated promptly, making the application of patches the only effective defense against CVE-2026-90970. The following steps outline the crucial self-hosted GitLab AI Gateway update steps:
- Update Docker Deployments: For Docker-based deployments, administrators must stop and remove the currently running container. Subsequently, pull and run the new, patched image tag. For example, to update to version 19.4.1, the command would involve pulling
self-hosted-v19.4.1-ee. - Update Helm Deployments: For deployments managed via Helm, the new image tag should be specified in the chart’s image settings.
- Version Compatibility: While GitLab’s installation guide advises aligning the gateway image with the GitLab minor version, the advisory does not explicitly state whether a 19.2.4 gateway is compatible with GitLab 19.1 or earlier, nor does it detail plans for fixes on older AI Gateway lines outside the 19.2, 19.3, and 19.4 releases, which are currently supported for security fixes according to GitLab’s maintenance policy.
Organizations should review their AI Gateway deployment documentation from the GitLab advisory to ensure a smooth and effective update process. Given the potential impact of command execution and the sensitive role of the AI Gateway, timely patching is the most critical step to secure these environments against potential exploitation.
Related: Metabase Zero-Day SQL Vulnerability Threatens Analytics Platforms, CVE-2026-32475: Elementor Pro Unauthenticated RCE Flaw