GitLab patches critical AI Gateway RCE flaw rated CVSS 9.9

October 3, 2026 at 12:38 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

GitLab released patches for CVE-2026-90970, a critical vulnerability in its AI Gateway with a CVSS score of 9.9. The flaw allows an authenticated user with Duo Agent Platform access to execute arbitrary commands on the host. Self-hosted instances must update manually, while GitLab-hosted services are already patched.

Key Facts

CVE-2026-90970 has a CVSS score of 9.9 and allows arbitrary command execution on the underlying host.
The vulnerability stems from insufficient sanitization of user-supplied flow configuration data, classified as CWE-1336.
Self-hosted GitLab instances must update to versions 19.2.4, 19.3.2, or 19.4.1.
As of October 3, 2026, there is no evidence of exploitation in the wild and no public proof-of-concept exploit.
In February 2026, Joern Schneeweisz identified CVE-2026-1868, a similar vulnerability in the same Duo Workflow Service component with CVSS 9.9.

Vulnerability Details

The flaw is classified under CWE-1336 and stems from insufficient sanitization of user-supplied flow configuration data. The AI Gateway uses Jinja2-style template placeholders to process these configurations, and the lack of proper neutralization allows an attacker to perform a sandbox escape. By breaking out of the intended execution context, the attacker gains the ability to execute commands directly on the host operating system.

Affected Systems and Patching

Self-hosted GitLab instances are exposed, while GitLab-hosted instances have already been patched. Operators of self-hosted instances must manually update to versions 19.2.4, 19.3.2, or 19.4.1. The AI Gateway acts as a central hub holding sensitive JWT signing keys and managing connections to internal GitLab instances and external AI model providers.

Context and Recurrence

In February 2026, Joern Schneeweisz identified CVE-2026-1868, a vulnerability in the same Duo Workflow Service component with CWE-1336 and CVSS 9.9. The recurrence of this vulnerability class within the same infrastructure layer indicates that the template-engine sandbox boundary remains a persistent point of failure for AI agent platforms. As of October 3, 2026, there is no evidence of exploitation in the wild, and no public proof-of-concept exploit has been published.