GitLab fixes AI Gateway critical vulnerability with score 9.9 that can lead to command execution on self-hosted servers

GitLab disclosed and fixed a critical vulnerability in AI Gateway on October 2, with a CVSS score of 9.9, numbered CVE-2026-90970. Logged-in users with access to the Duo Agent Platform could escape the prompt template sandbox through a specially crafted flow configuration, and then execute arbitrary commands on the gateway. The fixed versions are 19.2.4, 19.3.2, and 19.4.1; only organizations with self-hosted gateways need to upgrade, while GitLab.com, GitLab Dedicated, and self-managed instances using GitLab-hosted gateways require no action. The affected range covers versions 18.1.6 and later through 19.1; no fixed version is listed below 19.2.4, and the official source also did not provide temporary mitigations or methods for investigating attacks. CISA marked the vulnerability's exploitation status as none in the CVE record.