GitLab patches critical AI Gateway vulnerability

GitLab has released patches to address a critical vulnerability in its AI Gateway, identified as CVE-2026-90970. The flaw, which carries a CVSS score of 9.9, could allow an authenticated user with access to the Duo Agent Platform to escape a prompt template sandbox and execute arbitrary commands on the gateway host.

The vulnerability specifically affects organizations that self-host their AI Gateway, which serves as the intermediary between GitLab instances and AI models. Users with access to custom flow prompt templates could potentially exploit the flaw to run commands on the underlying system.

GitLab has already applied fixes to its own managed gateways. Customers using GitLab.com, GitLab Dedicated, or GitLab-hosted gateways do not need to take action. However, self-managed customers using self-hosted gateways are urged to update immediately to versions 19.2.4, 19.3.2, or 19.4.1. As of October 2, the Cybersecurity and Infrastructure Security Agency (CISA) reported no evidence of active exploitation in the wild.