GitLab AI Gateway CVE-2026-90970: a sandbox escape vulnerability rated 9.9
GitLab AI Gateway CVE-2026-90970: ein Sandbox-Ausbruch mit 9,9
On October 2, 2026, GitLab released critical AI Gateway patch versions 19.2.4, 19.3.2 and 19.4.1, fixing CVE-2026-90970, which has a CVSS score of 9.9: an authenticated user with access to the Duo Agent Platform can escape the Prompt template sandbox through a specially crafted Flow configuration and execute arbitrary commands on the gateway. The vulnerability corresponds to CWE-1336; AI Gateway repository documentation shows that its Prompt templates use Jinja, and the gateway holds JWT signing keys and sits on the path between GitLab instances and model backends. Affected versions are 18.1.6 through before 19.2.4, 19.3 through before 19.3.2, and 19.4 through before 19.4.1; no fixed versions are listed for 18.x and 19.1; GitLab-hosted gateways were fixed before release, and self-hosted deployments must replace the container themselves.
The article notes that the affected 18.x and 19.1 versions have no corresponding fix, and points out that this is the second template injection vulnerability of the same kind in this component within eight months.