GitLab fixes self-hosted AI Gateway template injection sandbox escape vulnerability CVE-2026-90970

GitLab disclosed and fixed the critical vulnerability CVE-2026-90970 (CVSS 3.1 score 9.9) in the self-hosted AI Gateway on October 2, 2026. Authenticated users with access to the Duo Agent Platform can escape the prompt template sandbox through a specially crafted flow configuration and execute arbitrary commands on the gateway host. The flaw is classified as CWE-1336, i.e., improper neutralization of special elements used in a template engine; affected versions are 18.1.6 through 19.2.3, 19.3.0 through 19.3.1, and 19.4.0, and fixed versions are 19.2.4, 19.3.2, and 19.4.1. The vendor provided no workaround. GitLab.com, GitLab Dedicated, and GitLab-hosted gateways are not affected.