The Pulse
GitLab Patches CVSS 9.9 RCE in Self-Hosted AI Gateway
GitLab released three patched AI Gateway versions to address a critical vulnerability that could let an authenticated user with Duo Agent Platform access execute commands on a self-hosted gateway. Customers using GitLab-hosted gateways are
AI.info Team · Written with AI ·
A 9.9 score for a gateway flaw
GitLab rates a newly patched AI Gateway vulnerability 9.9 out of 10, the highest band on the CVSS scale. The flaw could let an authenticated user with access to GitLab Duo Agent Platform escape a prompt-template sandbox and run arbitrary commands on the AI Gateway by supplying a specially crafted flow configuration.
GitLab published the advisory on Friday, October 2, identifying the issue as CVE-2026-90970. The company classifies it as critical and recommends that customers running affected self-hosted gateways upgrade immediately.
How the prompt-template sandbox failed
The vulnerability involves improper neutralization in a custom flow prompt template. A user who already has Duo Agent Platform access could exploit the weakness through a crafted flow configuration, escaping the sandbox and executing commands on the gateway. GitLab’s notice describes command execution on the AI Gateway; it does not say that the flaw gives an attacker unauthenticated access to the system.
“GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway.”
GitLab, in its security advisory
The CVSS vector records low attack complexity and low privileges required, with no user interaction. It also rates potential impacts to confidentiality, integrity and availability as high, and marks the vulnerability’s scope as changed.
Three patched releases cover affected branches
GitLab released AI Gateway versions 19.2.4, 19.3.2 and 19.4.1. The company says versions from 18.1.6 up to, but not including, 19.2.4 are affected; the affected ranges also include 19.3 releases before 19.3.2 and 19.4 releases before 19.4.1.
The AI Gateway provides access to AI-native GitLab Duo features. GitLab operates a cloud-based gateway used by GitLab.com, GitLab Self-Managed and GitLab Dedicated, while customers can also deploy their own gateway on GitLab Self-Managed through GitLab Duo Self-Hosted.
Those version ranges apply to the AI Gateway, not automatically to every installation of the broader GitLab platform. GitLab specifically tells customers with GitLab Self-Hosted AI Gateway installations to update to a patched version as soon as possible. The company says it contacted affected self-hosted customers with upgrade guidance before publishing the advisory.
GitLab-hosted gateways already have the fix
Customers using GitLab.com or GitLab Dedicated do not need to take action for this issue, according to GitLab, because the company has already deployed a fix to its hosted AI Gateways. The same applies to GitLab Self-Managed installations that connect to a GitLab-hosted gateway; the urgent upgrade instruction is for customers who operate their own gateway.
GitLab credits the HackerOne user invisiblemeerkat with responsibly disclosing the vulnerability. The advisory does not state that attackers have exploited the flaw, and it does not provide a public exploit or a detailed account of the underlying code defect.