GitLab fixes AI Gateway command execution vulnerability with score 9.9
Start here
GitLab disclosed and fixed a critical vulnerability in the self-hosted AI Gateway on October 2, 2026, numbered CVE-2026-90970, with a CVSS 3.1 score of 9.9, classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). Authenticated users with access to the Duo Agent Platform can escape the prompt template sandbox through a specially crafted flow configuration and execute arbitrary commands on the gateway host. Affected versions are 18.1.6 through 19.2.3, 19.3.0 through 19.3.1, and fixed versions are 19.2.4, 19.3.2, and 19.4.1. Only organizations with self-hosted gateways need to upgrade; GitLab.com and others using GitLab-hosted gateways are not affected.
Generated by AI from reports · Updated 4 days ago
Latest developments
Progress timeline
- 网页BleepingComputer· DiscussionGitLab warns of max severity code execution vulnerability(opens the original post in a new tab)
- CSA Labs ResearchSelectedGitLab fixes self-hosted AI Gateway template injection sandbox escape vulnerability CVE-2026-90970
GitLab disclosed and fixed the critical vulnerability CVE-2026-90970 (CVSS 3.1 score 9.9) in the self-hosted AI Gateway on October 2, 2026. Authenticated users with access to the Duo Agent Platform can escape the prompt template sandbox through a specially crafted flow configuration and execute arbitrary commands on the gateway host. The flaw is classified as CWE-1336, i.e., improper neutralization of special elements used in a template engine; affected versions are 18.1.6 through 19.2.3, 19.3.0 through 19.3.1, and 19.4.0, and fixed versions are 19.2.4, 19.3.2, and 19.4.1. The vendor provided no workaround. GitLab.com, GitLab Dedicated, and GitLab-hosted gateways are not affected.
- The Hacker NewsGitLab fixes AI Gateway critical vulnerability with score 9.9 that can lead to command execution on self-hosted servers
GitLab disclosed and fixed a critical vulnerability in AI Gateway on October 2, with a CVSS score of 9.9, numbered CVE-2026-90970. Logged-in users with access to the Duo Agent Platform could escape the prompt template sandbox through a specially crafted flow configuration, and then execute arbitrary commands on the gateway. The fixed versions are 19.2.4, 19.3.2, and 19.4.1; only organizations with self-hosted gateways need to upgrade, while GitLab.com, GitLab Dedicated, and self-managed instances using GitLab-hosted gateways require no action. The affected range covers versions 18.1.6 and later through 19.1; no fixed version is listed below 19.2.4, and the official source also did not provide temporary mitigations or methods for investigating attacks. CISA marked the vulnerability's exploitation status as none in the CVE record.
Related discussion
Attention trend
New sources per day
- Oct 3New1 sources (1 outlets,0 accounts)
- Oct 4New0 sources (0 outlets,0 accounts)
- Oct 5New0 sources (0 outlets,0 accounts)
- Oct 6New0 sources (0 outlets,0 accounts)
- Oct 7New0 sources (0 outlets,0 accounts)
- Oct 8New1 sources (1 outlets,0 accounts)
- Oct 9New0 sources (0 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New1 sources (1 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)